CVE-2026-2605
📋 TL;DR
Tanium's TanOS logs sensitive information that could be exposed to unauthorized users. This affects organizations using vulnerable Tanium deployments where logs are accessible to users with insufficient privileges.
💻 Affected Systems
- Tanium TanOS
📦 What is this software?
Tanos by Tanium
Tanos by Tanium
Tanos by Tanium
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to sensitive credentials, API keys, or configuration data from log files, leading to lateral movement or full system compromise.
Likely Case
Internal users with log access discover sensitive operational data, potentially violating compliance requirements or enabling privilege escalation.
If Mitigated
Log files remain inaccessible to unauthorized users, limiting exposure to only administrators with proper access controls.
🎯 Exploit Status
Exploitation depends on attacker gaining access to log storage locations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tanium security advisory TAN-2026-006 for specific patched versions
Vendor Advisory: https://security.tanium.com/TAN-2026-006
Restart Required: Yes
Instructions:
1. Review Tanium advisory TAN-2026-006. 2. Update TanOS to patched version. 3. Restart Tanium services. 4. Verify logging no longer contains sensitive data.
🔧 Temporary Workarounds
Restrict log file access
linuxApply strict file permissions to Tanium log directories to prevent unauthorized access
chmod 640 /var/log/tanium/*
chown root:tanium /var/log/tanium/*
Enable log encryption
allConfigure Tanium to encrypt sensitive log entries
🧯 If You Can't Patch
- Implement strict access controls on log storage directories
- Regularly audit and sanitize log files for sensitive information
🔍 How to Verify
Check if Vulnerable:
Review Tanium logs for presence of credentials, API keys, or other sensitive data in plaintextCheck Version:
tanium versionVerify Fix Applied:
After patching, confirm sensitive data is no longer logged in plaintext and check TanOS version📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to log directories
- Log files containing credentials or sensitive strings
Network Indicators:
- Unusual access patterns to log storage locations
SIEM Query:
source="tanium_logs" AND (password OR secret OR api_key OR token) NOT encrypted