Executive brief
Tenable Security Center contains a SQL injection vulnerability that allows authenticated administrators to execute arbitrary SQL queries. An attacker with administrative credentials could access sensitive data stored in the Security Center database, including credentials and configuration information, without requiring additional exploitation techniques.
Technical details
A SQL injection vulnerability exists in Security Center that allows authenticated users with high-level privileges (administrator role) to inject and execute arbitrary SQL queries against the backend database. The vulnerability is network-accessible, requires no user interaction, and does not require low-level privileges—only high-privilege (administrator) authentication. An attacker with admin credentials can achieve confidentiality breach (data extraction from the database including credentials) but cannot modify data or impact availability. Tenable released Security Center version 6.9.0 to address this vulnerability.
Affected products
- Tenable Security Center prior to 6.9.0
Timeline
- 2026-08-14: patched: Security Center 6.9.0 released
- 2026-08-14: disclosed