CVE-2025-15341: Tanium Benchmark Auth Bypass Vulnerability

CVE-2025-15341 Overview

CVE-2025-15341 is an incorrect default permissions vulnerability identified in Tanium Benchmark. This security flaw stems from improper permission configurations that could allow authenticated users with elevated privileges to access or modify sensitive data beyond their intended authorization scope. The vulnerability was addressed by Tanium through a security update.

Critical Impact

Authenticated attackers with high privileges could potentially compromise the confidentiality and integrity of sensitive data managed by Tanium Benchmark due to overly permissive default configurations.

Affected Products

• Tanium Benchmark (specific versions not disclosed)

Discovery Timeline

• 2026-02-05 - CVE CVE-2025-15341 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2025-15341

Vulnerability Analysis

This vulnerability is classified as CWE-276 (Incorrect Default Permissions), indicating that the affected software sets insecure default permissions during installation or configuration. The flaw requires network access and high-level privileges to exploit, but once those conditions are met, an attacker can potentially achieve unauthorized read and write access to protected resources.

The attack complexity is low, meaning that once an attacker has the required elevated privileges and network access, exploitation does not require specialized conditions or additional prerequisites. The vulnerability affects both confidentiality and integrity at a high level, though availability is not impacted.

Root Cause

The root cause of CVE-2025-15341 lies in the incorrect default permissions configuration within Tanium Benchmark. When the software is deployed, certain resources are configured with overly permissive access controls that do not follow the principle of least privilege. This allows users with high-level administrative access to potentially access or modify data that should be restricted even from privileged accounts, leading to potential confidentiality and integrity breaches.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an attacker to have high-privilege access to the affected Tanium Benchmark installation. An attacker with administrative credentials could leverage the incorrect default permissions to access sensitive benchmark data or configuration settings that should be restricted. This could enable unauthorized data exfiltration or manipulation of benchmark configurations, potentially affecting the integrity of security assessments across the organization.

The vulnerability does not require user interaction and operates within the scope of the vulnerable component without propagating to other systems.

Detection Methods for CVE-2025-15341

Indicators of Compromise

• Unexpected access to restricted benchmark configuration files or data stores
• Audit log entries showing administrative users accessing resources outside their normal scope
• Permission changes to sensitive benchmark data without corresponding change management tickets

Detection Strategies

• Review Tanium Benchmark access logs for anomalous administrative access patterns
• Implement file integrity monitoring on benchmark configuration directories
• Enable verbose logging for permission checks and access control decisions in Tanium Benchmark

Monitoring Recommendations

• Configure alerts for any modifications to default permission settings in Tanium Benchmark
• Establish baseline administrative access patterns and alert on deviations
• Monitor for bulk data access or export operations from benchmark data repositories

How to Mitigate CVE-2025-15341

Immediate Actions Required

• Review the Tanium Security Advisory TAN-2025-029 for specific remediation guidance
• Audit current permission configurations on Tanium Benchmark installations
• Restrict administrative access to only essential personnel until patches are applied
• Implement additional access controls and monitoring on sensitive benchmark data

Patch Information

Tanium has addressed this vulnerability and released a security patch. Organizations should consult the Tanium Security Advisory TAN-2025-029 for detailed patch information, affected version specifics, and upgrade instructions. It is recommended to apply the latest security update as soon as possible following your organization's change management procedures.

Workarounds

• Manually audit and restrict default permissions on Tanium Benchmark installations to follow least privilege principles
• Implement network segmentation to limit access to Tanium Benchmark servers
• Enable comprehensive audit logging to track all administrative actions
• Consider implementing additional authentication controls for sensitive benchmark operations