Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and serve sensitive data to unauthenticated users even after authentication is applied.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 HIGH: CVE-2026-13007 (CVSS 7.5) Tenable Identity Exposure exposes unauthenticated API endpoints (/w/api/*) leaking cleartext LDAP credentials, SAML configs & user accounts. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/8NOpR9Nbce
Post summary
The tweet announces CVE-2026-13007, noting an unauthenticated API vulnerability that leaks credentials and urges users to apply a patch immediately.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | tenable | identity_exposure | - | - | - |