CVE-2026-13007 describes a missing authentication vulnerability in Tenable Identity Exposure where multiple API endpoints under /w/api/* expose sensitive application configuration data to unauthenticated remote attackers. The exposed data includes cleartext LDAP credentials, SAML configuration, user accounts, and directory settings. Additionally, the affected responses use Cache-Control: public headers and omit Vary: Cookie headers, which can cause reverse proxies and CDNs to cache and serve this sensitive data to unauthenticated users even after authentication mechanisms are applied. The CVSS 3.1 base score is 7.5, indicating a high severity vulnerability with network attack vector, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

Remote unauthenticated attackers can retrieve sensitive configuration data including cleartext LDAP credentials and SAML configuration, potentially enabling further attacks or unauthorized access. The caching headers increase the risk by allowing intermediaries to cache and serve sensitive data to unauthorized users even after authentication is implemented, extending the exposure window.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints and review caching configurations on reverse proxies and CDNs to prevent caching of sensitive responses. Monitor for vendor updates regarding patches or official mitigations.