CVE-2026-13007: Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure
Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/ that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and serve sensitive data to unauthenticated users even after authentication is applied.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Tenable Identity Exposure REST API responses under /w/api/* to prevent insecure public caching of sensitive data by removing/avoiding 'Cache-Control: public' and adding 'Vary: Cookie' so reverse proxies/CDNs do not serve cached content to unauthenticated users.
Reverse proxy/CDN caching behavior for REST API endpoints (/w/api/*) Cache-Control / Vary headers = Ensure responses are not publicly cacheable (e.g., do not set Cache-Control: public) and include Vary: Cookie on authenticated responses
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13007?
The severity of CVE-2026-13007 is high, with a score of 8.7.
What vulnerabilities are associated with CVE-2026-13007?
CVE-2026-13007 exposes sensitive application configuration data through unauthenticated API endpoints.
How do I fix CVE-2026-13007?
To fix CVE-2026-13007, ensure that sensitive API endpoints are secured and require authentication.
What types of sensitive data does CVE-2026-13007 expose?
CVE-2026-13007 exposes cleartext LDAP credentials, SAML configuration, user accounts, and directory settings.
Who is affected by CVE-2026-13007?
Any user of Tenable Identity Exposure that has unauthenticated access to the API endpoints is at risk from CVE-2026-13007.