EUVD-2026-38487
GHSA-rqcc-h287-275c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable /w/api/* endpoints require no authentication or user interaction (AV:N/AC:L/PR:N/UI:N); impact is pure confidentiality disclosure of credentials and config (C:H, I:N, A:N).
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
7DescriptionCVE.org
Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and serve sensitive data to unauthenticated users even after authentication is applied.
AnalysisAI
Unauthenticated information disclosure in Tenable Identity Exposure versions prior to 3.93.5 allows remote attackers to retrieve cleartext LDAP credentials, SAML configuration, user accounts, and directory settings via API endpoints under /w/api/*. The flaw is compounded by Cache-Control: public response headers that lack a Vary: Cookie directive, allowing reverse proxies and CDNs to cache and re-serve the sensitive data to other unauthenticated requesters. No public exploit identified at time of analysis, but the issue was disclosed by the vendor itself.
Technical ContextAI
Tenable Identity Exposure (formerly Tenable.ad) is an Active Directory security posture and threat detection product that ingests directory metadata, LDAP bind credentials, and SSO/SAML configuration. The underlying weakness is CWE-306 (Missing Authentication for Critical Function): a set of REST endpoints under the /w/api/* path are reachable without an authenticated session and return configuration material that should be access-controlled. The cache-header behavior (Cache-Control: public with no Vary: Cookie) is a secondary web-caching defect that means even after upstream authentication is enforced, intermediate caches such as nginx, Varnish, or CDN edges may have stored - and continue to serve - copies of the privileged responses to anonymous clients. CPE cpe:2.3:a:tenable:tenable_identity_exposure:*:*:*:*:*:*:*:* covers all version strings of the product family.
RemediationAI
Vendor-released patch: Tenable Identity Exposure 3.93.5 - upgrade to this release or later per the Tenable advisory at https://www.tenable.com/security/research/tns-2026-16. As immediate compensating controls until the upgrade is deployed, restrict network reachability of the /w/api/* path to trusted management networks via WAF or reverse-proxy ACLs (side effect: legitimate admin tooling that calls these endpoints from other networks will break), and on any fronting reverse proxy or CDN purge cached responses for /w/api/* and override response headers to force Cache-Control: no-store plus Vary: Cookie so that stale anonymous-cacheable copies are evicted and not regenerated. Because LDAP credentials may already have been exfiltrated or cached, rotate the LDAP bind account password and review SAML signing/IdP secrets after patching, and audit reverse proxy and CDN logs for prior unauthenticated GETs to /w/api/*.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today