Tanium Comply Access Control and Injection Flaws

Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's intended directory scope, resulting in high confidentiality impact and scope change to the broader host system. The CVSS vector (S:C, C:H) indicates the traversal can reach resources beyond the Comply component itself, potentially exposing sensitive configuration, credentials, or endpoint compliance data accessible to the Tanium platform. No public exploit code or CISA KEV listing has been identified at time of analysis.

Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write against the underlying host. The CVSS vector (AV:N/AC:L/PR:L/S:C/I:H) confirms the vulnerability is network-reachable without administrative credentials and breaks containment boundaries beyond the Comply module itself. Tanium addressed the issue under advisory TAN-2026-043; no public exploit code or CISA KEV listing is currently identified.

SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user interaction and high attack complexity - to execute arbitrary SQL against the backend database, with a scope change that extends impact beyond the Comply application itself to C:H/I:H/A:H. Tanium addressed this in advisory TAN-2026-042. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.

Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations with high integrity and availability impact over the network. Exploiting this CWE-863 (Incorrect Authorization) flaw, an attacker with minimal authenticated access can bypass authorization enforcement within the Comply module, potentially altering compliance posture data or disrupting compliance workflows. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed.

Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to perform unauthorized actions, producing high integrity and availability impact across the platform. Tanium disclosed this vulnerability via advisory TAN-2026-041; the CVSS 8.1 score reflects network-reachable exploitation requiring only a valid low-privilege account with no user interaction. No public exploit code or active exploitation has been identified at time of analysis.

Server-side template injection (SSTI) in Tanium Comply enables remote code execution by a highly privileged authenticated user, yielding full confidentiality, integrity, and availability impact on the Comply server. The vulnerability (CWE-1336) results from insufficient neutralization of template directives in user-controlled input, allowing the underlying template engine to evaluate and execute injected payloads server-side. Tanium addressed this in advisory TAN-2026-040; no public exploit code or CISA KEV listing has been identified at time of analysis.

Improper access controls (CWE-862 Missing Authorization) in Tanium Comply expose compliance and vulnerability assessment data to authenticated users who lack sufficient privileges to access it. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) scores this at 7.1, with high confidentiality impact and limited integrity risk, exploitable over the network by any low-privileged Tanium account holder with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.