CVE-2026-13007 Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure
Unauthenticated attackers can access sensitive configuration data, including cleartext credentials, via insecurely cached public API endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13007?
CVE-2026-13007 is a high-severity vulnerability in Tenable Identity Exposure, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and serve sensitive data to unauthenticated users even after authentication is applied.
Which versions are affected by CVE-2026-13007?
It affects 1 product.
Products include Tenable Identity Exposure.
How do I fix CVE-2026-13007?
No fix has been published for CVE-2026-13007 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-13007 being exploited?
There is no known exploitation of CVE-2026-13007 in the wild and no public exploit code.
Other vulnerabilities in Tenable Identity Exposure
Sources
Also known as GHSA-rqcc-h287-275c.