Vulnerability · Published Jun 23, 2026 · Assigned by tenable

CVE-2026-13007Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure

High 7.5

In plain English

A high-severity missing authentication in Tenable Identity Exposure from tenable. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 50.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and serve sensitive data to unauthenticated users even after authentication is applied.

Affected products (as reported)

Vendor	Product	Versions
tenable	Tenable Identity Exposure	0 – before 3.93.5

Weakness: CWE-306, CWE-524 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

TNS-2026-16 vendor-advisory