CVE-2025-12810
📋 TL;DR
An improper authentication vulnerability in Delinea Secret Server On-Prem allows secrets with 'change password on check in' enabled to automatically check in even when password rotation fails. This leaves secrets in an inconsistent state with incorrect passwords. Affects Secret Server On-Prem versions 11.8.1, 11.9.6, and 11.9.25.
💻 Affected Systems
- Delinea Secret Server On-Prem
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Critical secrets become inaccessible with incorrect passwords, causing service disruptions and requiring manual recovery of potentially hundreds of systems.
Likely Case
Password rotation failures for managed accounts leave secrets with outdated credentials, requiring manual intervention to restore access.
If Mitigated
With proper monitoring and alerting on password rotation failures, administrators can manually intervene before significant impact occurs.
🎯 Exploit Status
Exploitation occurs automatically as part of normal system operation when password rotation fails, not requiring attacker intervention.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.9.47 or later
Vendor Advisory: https://trust.delinea.com/?tcuUid=48260de9-954d-45c2-9c66-2c9510798a0b
Restart Required: Yes
Instructions:
1. Backup Secret Server database and configuration. 2. Download version 11.9.47 or later from Delinea portal. 3. Run installer on Secret Server host. 4. Restart Secret Server services. 5. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Disable automatic check-in for password rotation
allTemporarily disable 'change password on check in' for all secrets to prevent automatic check-in when rotation fails.
Navigate to Secret Settings → Edit Secret → Password Options → Uncheck 'Change password on check in'
🧯 If You Can't Patch
- Implement monitoring for password rotation failures and alert administrators immediately
- Establish manual verification process for all password changes before allowing check-in
🔍 How to Verify
Check if Vulnerable:
Check Secret Server version in web interface under Help → About. If version is 11.8.1, 11.9.6, or 11.9.25, system is vulnerable.Check Version:
Check web interface: Help → About, or query database: SELECT * FROM tbVersionVerify Fix Applied:
After upgrade, verify version is 11.9.47 or later. Test password rotation with 'change password on check in' enabled to confirm secret remains checked out on failure.📡 Detection & Monitoring
Log Indicators:
- Password rotation failure events followed by automatic check-in events in Secret Server logs
- Event IDs related to password change failures in Windows Event Logs
Network Indicators:
- Increased failed authentication attempts from systems using rotated credentials
SIEM Query:
source="secret_server" AND (event_type="password_rotation_failure" AND action="check_in")