CVE-2026-13007: Tenable Identity Exposure Unauthenticated API Credential Exposure

Technical summary

The vulnerability stems from missing authentication controls on a range of API endpoints under the /w/api/* path in Tenable Identity Exposure. These endpoints return sensitive application metadata including LDAP credentials in cleartext, SAML configuration parameters, active user accounts, and directory service settings. The HTTP response headers include Cache-Control: public without a Vary: Cookie directive, violating cache control best practices. This misconfiguration allows intermediate caches (reverse proxies, CDNs, shared proxies) to store responses and serve them to subsequent unauthenticated requesters. The issue is classified under CWE-306 (Missing Authentication for Critical Function) and CWE-524 (Use of Cache Containing Sensitive Information), reflecting both the missing auth layer and the caching exposure vector.

Business impact

Compromise of LDAP and SAML credentials enables lateral movement within your directory infrastructure and identity federation systems. Directory enumeration allows attackers to map user populations, departments, and access patterns. If cached responses are served by CDNs or edge proxies, the exposure window extends beyond direct network access—cached data may persist across multiple customer requests and geographic regions. This broadens the attack surface and complicates containment. For organizations using Identity Exposure to manage privileged identities or federated access, credential exposure directly enables unauthorized account takeover and privilege escalation.

Affected systems

Tenable Identity Exposure is affected. Specific version ranges are not detailed in the published advisory; verify the vendor security bulletin for the precise affected release versions and any available patches or workarounds.

Exploitability

Exploitability is straightforward: the vulnerability requires only network access and an HTTP client. No authentication, user interaction, or special configuration is needed. An attacker can trivially enumerate the /w/api/* endpoints and extract credentials and settings from unauthenticated responses. The cacheable response headers lower the barrier further—an attacker can trigger caching via a public request, then rely on intermediate systems to serve the cached sensitive data. The CVSS 3.1 score of 7.5 (HIGH) reflects high confidentiality impact with no prerequisites and a low attack complexity.

Remediation

1. Immediately apply Tenable's security patch once released; verify the exact version requirement in the vendor advisory. 2. If a patch is unavailable, restrict network access to Identity Exposure endpoints via firewall or network segmentation, limiting exposure to trusted administrative subnets only. 3. Audit and rotate all LDAP, SAML, and directory service credentials exposed by these endpoints. 4. Flush caches in all intermediate systems (reverse proxies, CDNs, load balancers) that may have cached responses from the /w/api/* endpoints. 5. Review access logs to determine if the endpoints were queried by unauthorized clients before the fix was applied. 6. Update cache control headers application-wide to include Vary: Cookie and remove public cacheability from authenticated endpoints.

Patch guidance

Consult Tenable's official security advisory for CVE-2026-13007 to identify the patched version and deployment steps. Prioritize patching systems in production environments that serve user identity and directory data. Verify patch deployment by confirming that unauthenticated requests to /w/api/* endpoints now return authentication errors (401 or 403) rather than sensitive data. Test cache behavior after patching to ensure credentials and configuration are no longer cached by intermediate systems.

Detection guidance

Monitor access logs for unauthenticated HTTP requests to endpoints matching /w/api/*. Look for successful responses (HTTP 200) containing LDAP, SAML, or directory configuration keywords in response bodies. Check for unusual patterns of API enumeration or repeated requests to configuration endpoints from external or non-administrative IP ranges. Review CDN and reverse proxy logs for cache hits on sensitive endpoints. Correlate cache timestamps with exposure window to estimate the scope of cached data distribution. Deploy network detection signatures for common Identity Exposure API paths if available from your SIEM or IDS vendor.

Why prioritize this

Prioritize this vulnerability as HIGH. Unauthenticated access to cleartext credentials and configuration data directly enables account takeover and infrastructure reconnaissance. The caching vector expands exposure beyond direct network attackers, potentially affecting users across multiple geographic regions via CDN distribution. The combination of missing authentication and caching misconfiguration is a compounding factor that elevates risk significantly. Organizations relying on Identity Exposure for privileged access or federation should patch immediately.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects high confidentiality impact (CWE-306: missing authentication on a critical function) with low attack complexity and no authentication required. The vulnerability does not cause integrity or availability impact, keeping the score below 8.0, but the exposure of credentials and configuration data to any network attacker without privilege elevation justifies the HIGH severity rating. The caching misconfiguration (CWE-524) amplifies real-world risk beyond the CVSS baseline by allowing persistent, distributed exposure.

Frequently asked questions