CVE-2026-6408
Information Disclosure Vulnerability in Tanium Server
Publication date: 2026-04-22
Last updated on: 2026-05-05
Assigner: Tanium
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tanium | server | From 7.6.4.0 (inc) to 7.6.4.2185 (exc) |
| tanium | server | From 7.7.3.0 (inc) to 7.7.3.8266 (exc) |
| tanium | server | From 7.8.2.0 (inc) to 7.8.2.1168 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-522 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-6408 is an information disclosure vulnerability in Tanium Server. It allows an authenticated Tanium user who has either the Administrator role or the "Write Downloader Authentication" permission to retrieve credentials used for remote source download authentication.
This vulnerability has a low severity with a CVSS 3.1 base score of 2.7.
Affected versions include Tanium Server versions prior to certain updates in the 2024H2, 2025H1, and 2025H2 releases.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing certain authenticated users with elevated permissions to access sensitive credentials used for remote source download authentication.
If these credentials are accessed, it could lead to unauthorized access to remote sources or systems that rely on these credentials.
It is recommended to apply the available updates and rotate any potentially compromised credentials to mitigate this risk.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or methods provided to identify this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should apply the available updates that address the issue:
- For 2024H2 Release: Update 23 (v7.6.4.2185) and later
- For 2025H1 Release: Update 17 (v7.7.3.8266) and later
- For 2025H2 Release: Update 7 (v7.8.2.1168) and later
Additionally, it is recommended to rotate any potentially compromised credentials that could have been accessed by users with the affected permissions.
Can you explain this vulnerability to me?
CVE-2026-6408 is an information disclosure vulnerability in Tanium Server. It allows an authenticated Tanium user who has either the Administrator role or the "Write Downloader Authentication" permission to retrieve credentials used for remote source download authentication.
This vulnerability has a low severity with a CVSS 3.1 base score of 2.7.
Affected versions include Tanium Server versions prior to certain updates in the 2024H2, 2025H1, and 2025H2 releases.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of credentials used for remote source download authentication if an attacker has the required permissions.
This could potentially allow an attacker with those permissions to access sensitive authentication credentials, which might be used to compromise other systems or data.
It is recommended to apply the available updates and rotate any potentially compromised credentials to mitigate the impact.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should apply the available updates for your Tanium Server version as soon as possible.
- For 2024H2 Release: Update 23 (v7.6.4.2185) or later
- For 2025H1 Release: Update 17 (v7.7.3.8266) or later
- For 2025H2 Release: Update 7 (v7.8.2.1168) or later
Additionally, it is recommended to rotate any potentially compromised credentials that could have been accessed by users with the Administrator role or the "Write Downloader Authentication" permission.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-6408 is an information disclosure vulnerability that allows certain authenticated users to retrieve credentials used for remote source download authentication. This exposure of sensitive credentials could potentially impact compliance with standards and regulations such as GDPR and HIPAA, which require protection of sensitive information and credentials.
However, the provided information does not explicitly describe the direct effects on compliance with these standards or regulations.
Can you explain this vulnerability to me?
CVE-2026-6408 is an information disclosure vulnerability in Tanium Server. It allows an authenticated Tanium user who has either the Administrator role or the "Write Downloader Authentication" permission to retrieve credentials used for remote source download authentication.
This vulnerability has a low severity with a CVSS 3.1 base score of 2.7.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of credentials used for remote source download authentication if an attacker has the required permissions.
This could potentially allow an attacker with those permissions to access or misuse sensitive authentication credentials.
It is recommended to apply the available updates and rotate any potentially compromised credentials to mitigate the impact.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability allows an authenticated Tanium user with Administrator role or "Write Downloader Authentication" permission to retrieve credentials used for remote source download authentication.
No specific detection commands or methods are provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
The only mitigation provided is to apply the available updates that address this vulnerability.
- For 2024H2 Release: Update 23 (v7.6.4.2185) and later
- For 2025H1 Release: Update 17 (v7.7.3.8266) and later
- For 2025H2 Release: Update 7 (v7.8.2.1168) and later
It is also recommended to rotate any potentially compromised credentials that could have been accessed by users with the affected permissions.
Can you explain this vulnerability to me?
CVE-2026-6408 is an information disclosure vulnerability in Tanium Server. It allows an authenticated Tanium user who has either the Administrator role or the "Write Downloader Authentication" permission to retrieve credentials used for remote source download authentication.
This vulnerability has a low severity with a CVSS 3.1 base score of 2.7.
Affected Tanium Server versions are prior to specific updates in the 2024H2, 2025H1, and 2025H2 releases.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of credentials used for remote source download authentication if an attacker has the required permissions.
This could potentially allow misuse of those credentials, leading to further unauthorized access or actions within the affected system.
It is recommended to apply the provided updates and rotate any potentially compromised credentials to mitigate the impact.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or methods provided to identify this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should apply the available updates that address the issue:
- For 2024H2 Release: Update 23 (v7.6.4.2185) and later
- For 2025H1 Release: Update 17 (v7.7.3.8266) and later
- For 2025H2 Release: Update 7 (v7.8.2.1168) and later
Additionally, it is recommended to rotate any potentially compromised credentials that could have been accessed by users with the affected permissions.
No other workarounds or mitigations are provided beyond applying these updates.