CVE-2026-4387: StrongDM State File Reuse

StrongDM remediated this vulnerability as of March 17, 2026 The fix uses platform-native credential storage (macOS Keychain, DPAPI) rather than storing credentials in plaintext in state. kv. Desktop version 23. 74. 0 and CLI version 53.

77. 0 contain the fix and older versions should update to these or newer versions. StrongDM provided SpecterOps with a test environment to retest and validate the remediation worked as expected. Operators confirmed the fix worked as expected and authentication material was no longer stored in plaintext. While the state.

kv file is still present and contains public and private keys, it no longer contains the required JWT. The data_1 file also no longer contains the JWT issued during authentication. SpecterOps attempted to decrypt the DPAPI blob but were unable to do so with SharpDPAPI tooling. Further testing showed that moving files from one host to another no longer worked to provide an authenticated session on an external host. SpecterOps tested between May 11-14, 2026 using version 23.

74. 0.