Read the docs
TI-2026-11066 Aliases CVE-2026-13007GHSA-rqcc-h287-275c

Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure

Priority MEDIUM 44CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and serve sensitive data to unauthenticated users even after authentication is applied.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0061 49th percentileScored 2026-11-07
Fix Fixed Tenable Identity Exposure (tenable): 3.93.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TenableTenable Identity Exposurebefore 3.93.53.93.5Patch availableCNA
  • Tenable Identity Exposure VendorTenable Affected before 3.93.5 Fixed in 3.93.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tenable:identity_exposure:*:*:*:*:on-premises:*:*:*before 3.93.5VulnerableTenable
  • cpe:2.3:a:tenable:identity_exposure:*:*:*:*:on-premises:*:*:* Versions before 3.93.5 Vulnerable ·Tenable

Remediation

  • Fix · CNA Tenable Identity Exposure (tenable) Fixed in 3.93.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-13007
  2. 2026-10-03 Alias added: GHSA-rqcc-h287-275c

References

Advisory 1

  • TI-2024-03030 Formula Injection Vulnerability CVSS 3.1HIGH 7.6
  • TI-2024-01564 DLL Injection in Tenable Identity Exposure Secure Relay CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences