CVE-2026-87116 Overview
CVE-2026-87116 is a server-side request forgery (SSRF) vulnerability [CWE-918] in Tanium Threat Response. Tanium addressed the flaw in a security advisory published under reference TAN-2026-050. An authenticated attacker with low privileges can coerce the Threat Response server into issuing HTTP requests to attacker-chosen destinations over the network. The confidentiality impact is high, while integrity and availability are unaffected.
Critical Impact
An authenticated network-adjacent attacker can abuse Threat Response to reach internal services and exfiltrate sensitive data, including cloud metadata and internal application responses.
Affected Products
- Tanium Threat Response (see Tanium Security Advisory TAN-2026-050 for fixed versions)
Discovery Timeline
- 2026-09-16 - CVE-2026-87116 published to the National Vulnerability Database (NVD)
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-87116
Vulnerability Analysis
The vulnerability resides in Tanium Threat Response, a module of the Tanium platform used for endpoint detection, investigation, and response. It is classified as server-side request forgery under [CWE-918]. Exploitation requires network access to the Threat Response service and valid low-privilege credentials, but no user interaction.
Successful exploitation lets the attacker force the server to make outbound HTTP or HTTPS requests to arbitrary destinations. Those destinations can include internal-only endpoints that are otherwise unreachable from the attacker's network position. The scope is unchanged, and the impact is limited to information disclosure from the server's perspective.
Root Cause
SSRF flaws generally originate from insufficient validation of user-controlled URLs, hostnames, or IP addresses before the server initiates a request on behalf of the caller. In this class of issue, the application accepts a target parameter and passes it to a backend HTTP client without enforcing an allowlist, blocking loopback and link-local ranges, or restricting redirects. Tanium has not published detailed root-cause information beyond acknowledging the SSRF condition in advisory TAN-2026-050.
Attack Vector
The attack is remote and requires authentication. An attacker with a valid account submits a crafted request to a Threat Response endpoint that accepts a URL or hostname. The server then performs an outbound request to that destination, returning content or metadata that the attacker can read.
Common SSRF exploitation targets include cloud instance metadata services (for example, IMDS endpoints on managed instances), internal administrative interfaces, and services bound to loopback. Refer to the Tanium Security Advisory TAN-2026-050 for vendor-specific exploitation constraints.
Detection Methods for CVE-2026-87116
Indicators of Compromise
- Outbound HTTP or HTTPS requests from the Tanium Threat Response server to unexpected internal IP ranges, loopback addresses, or cloud metadata endpoints.
- Threat Response application logs showing user-supplied URL parameters that reference private-range hosts, DNS rebinding candidates, or non-standard schemes.
- Anomalous authentication events for low-privilege Tanium accounts immediately preceding unusual server-initiated network traffic.
Detection Strategies
- Baseline the normal outbound destinations of the Threat Response server and alert on deviations, especially requests to RFC1918, 169.254.169.254, or 127.0.0.0/8.
- Inspect proxy and firewall logs for server-originated requests correlated with authenticated Tanium API calls.
- Review Threat Response audit trails for parameters accepting URLs and flag values pointing to internal infrastructure.
Monitoring Recommendations
- Forward Tanium application, proxy, and network flow logs to a centralized analytics platform for correlation.
- Monitor cloud metadata service access patterns from any host running Tanium components.
- Track failed and successful authentication events for Threat Response users and correlate with outbound network activity.
How to Mitigate CVE-2026-87116
Immediate Actions Required
- Apply the fixed version of Tanium Threat Response identified in Tanium Security Advisory TAN-2026-050.
- Rotate credentials for low-privilege Tanium accounts if suspicious server-side outbound traffic is observed.
- Restrict which users can access Threat Response endpoints that accept URL-style parameters.
Patch Information
Tanium has published a security advisory acknowledging and remediating the SSRF vulnerability in Threat Response. Administrators should consult Tanium Security Advisory TAN-2026-050 for affected version ranges, fixed builds, and upgrade guidance.
Workarounds
- Place the Tanium Threat Response server behind an egress proxy that enforces an allowlist of permitted destinations.
- Block outbound access from the Threat Response host to cloud metadata addresses such as 169.254.169.254 and to internal management networks that do not require Tanium connectivity.
- Apply least-privilege role assignments so that only necessary operators can invoke Threat Response features that fetch remote resources.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
