CVE-2026-108326

MediumCVSS 6.5/10Last modified Nov 4, 2026

Description

Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

Weakness enumeration

CWE-295

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Tanium	Endpoint Configuration Toolset Solution	>= 1.51, < 1.51.60; >= 1.59, < 1.59.50; >= 1.71, < 1.71.25
Tanium	cx-stream	>= 2.4.1184, < 2.4.1184; >= 2.7.1160, < 2.7.1160; >= 2.8.1465, < 2.8.1465; >= 2.9.561, < 2.9.561

References

https://security.tanium.com/TAN-2026-060

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1083275.0Tanium addressed a path traversal vulnerability in Tanium Data Service.CVE-2026-1083284.2Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response.CVE-2026-1083298.8Tanium addressed an unauthorized code execution vulnerability in Threat Response.CVE-2026-108336.4The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Script CVE-2026-1083303.6Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.CVE-2026-1083313.3Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.CVE-2026-1083326.3Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.CVE-2026-1083332.5Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.CVE-2026-1083347.4A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines wh CVE-2026-1083359.1When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attac CVE-2026-1083369.1When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate fo CVE-2026-1083377.4An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in