CVE-2026-13007: Tenable Identity Exposure API Vulnerability

CVE-2026-13007 Overview

CVE-2026-13007 affects Tenable Identity Exposure, exposing sensitive configuration data through unauthenticated API endpoints under /w/api/*. Remote attackers can retrieve cleartext Lightweight Directory Access Protocol (LDAP) credentials, Security Assertion Markup Language (SAML) configuration, user accounts, and directory settings without authentication. Affected responses include Cache-Control: public headers and omit Vary: Cookie, allowing reverse proxies and content delivery networks (CDNs) to cache and serve sensitive data to other unauthenticated users. The weakness maps to [CWE-306] Missing Authentication for Critical Function.

Critical Impact
Unauthenticated remote attackers can harvest cleartext LDAP credentials and identity configuration data, enabling lateral movement into Active Directory and federated identity systems.

Affected Products

Tenable Identity Exposure
Tenable Identity Exposure deployments behind caching reverse proxies
Tenable Identity Exposure deployments behind CDNs

Discovery Timeline

2026-06-23 - CVE-2026-13007 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-13007

Vulnerability Analysis

The vulnerability stems from multiple API endpoints under the /w/api/* path that do not enforce authentication. These endpoints return application configuration data intended for authenticated administrators. Attackers issuing direct HTTP GET requests receive JSON payloads containing LDAP bind credentials in cleartext, SAML identity provider settings, user account records, and directory connection parameters.

The issue is compounded by improper HTTP cache directives. Responses are served with Cache-Control: public and lack a Vary: Cookie header. Intermediate caches treat the responses as shareable across users. Once a sensitive response is cached, any subsequent request to the same URL receives the cached payload, even if administrators later add authentication controls in front of the application.

Root Cause

The root cause is missing authentication on API endpoints that expose privileged configuration data, combined with insecure cache control headers. The application treats /w/api/* routes as publicly cacheable resources rather than per-user authenticated responses.

Attack Vector

An unauthenticated attacker sends HTTP requests to the exposed endpoints under /w/api/* from any network position that can reach the Tenable Identity Exposure web interface. No user interaction or privileges are required. Attackers can also retrieve cached responses from upstream proxies or CDNs without ever contacting the origin server. See the Tenable Security Research Advisory for endpoint details.

Detection Methods for CVE-2026-13007

Indicators of Compromise

Unauthenticated HTTP GET requests to URIs matching /w/api/* in web server or reverse proxy access logs.
Outbound responses containing LDAP bind DNs, password fields, or SAML metadata served without a session cookie present on the request.
CDN or reverse proxy cache entries keyed to /w/api/* paths with Cache-Control: public directives.
Spikes in anonymous requests to Identity Exposure API endpoints from unfamiliar source addresses.

Detection Strategies

Inspect proxy and load balancer logs for requests to /w/api/* that lack authentication headers or session cookies.
Hunt for responses returning JSON keys associated with LDAP, SAML, or directory configuration in network capture or web application firewall (WAF) telemetry.
Correlate successful LDAP authentication events in Active Directory with prior unauthenticated requests to Identity Exposure to identify credential reuse.

Monitoring Recommendations

Enable verbose access logging on the Identity Exposure front-end and forward to a centralized log platform.
Alert on any HTTP 200 response to /w/api/* paths that exceeds a baseline response size, indicating configuration data exfiltration.
Monitor CDN and reverse proxy cache contents for entries matching the vulnerable URI pattern and purge them on detection.

How to Mitigate CVE-2026-13007

Immediate Actions Required

Apply the vendor patch referenced in the Tenable Security Research Advisory to all Tenable Identity Exposure instances.
Rotate all LDAP service account credentials, SAML signing keys, and any other secrets stored in the application configuration.
Purge cached responses for /w/api/* paths from all reverse proxies and CDNs in front of the application.
Restrict network access to the Identity Exposure management interface to trusted administrative networks until patching completes.

Patch Information

Tenable has published a security advisory and fixed release for this issue. Refer to the Tenable Security Research Advisory tns-2026-16 for the patched version and upgrade instructions.

Workarounds

Block external access to URIs matching /w/api/* at the reverse proxy or WAF until the patch is applied.
Override response headers at the proxy layer to set Cache-Control: no-store and Vary: Cookie for all /w/api/* paths.
Disable caching for the Identity Exposure origin in upstream CDNs.

bash

# Example NGINX configuration to block unauthenticated API exposure
location ~* ^/w/api/ {
    add_header Cache-Control "no-store" always;
    add_header Vary "Cookie" always;
    # Restrict to administrative network until patch is applied
    allow 10.0.0.0/24;
    deny all;
}