CVE-2026-13007: Tenable Identity Exposure

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and serve sensitive data to unauthenticated users even after authentication is applied.

Affected products

• Tenable Identity Exposure: before 3.93.5 (fixed in 3.93.5)

Published 2026-06-23. Last modified 2026-08-19.