SearchSubscribe

TRA-2026-41

Cross-tenant data access through misconfigured federated identity

Federation tokens issued for one tenant were accepted by sibling tenants sharing an issuer, exposing their storage buckets.

  • Patched
  • Cloud

CVSS 3.1 base score

8.1high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Vendor
Northwind Cloud
Product
Northwind Identity Federation
CVE
  • CVE-2026-38820
Disclosure
103 days
Researchers
Rémi Laurent

Score breakdown

Exploitability

Attack vector
Attack complexity
Privileges required
User interaction

Scope

Scope

Impact

Confidentiality
Integrity
Availability

Affected products

ProductAffectedFixed in
Northwind Identity FederationService, before 2026-09-12Service update 2026-09-12

Read the research

Questions about this advisory

research@tenable.com
On this page6 sections
  1. Score breakdown
  2. Affected products
  3. Synopsis
  4. Proof of concept
  5. Solution
  6. Disclosure timeline

Synopsis

Federation tokens issued for one tenant were accepted by sibling tenants sharing an issuer, exposing their storage buckets.

Proof of concept

Tenable has shared a proof of concept with Northwind Cloud. It is not published here, to give operators time to apply the fix.

Solution

Northwind Cloud fixed the issue server-side. No customer action is required, but we recommend reviewing access logs for cross-tenant token use before the fix date.

Disclosure timeline

  1. Tenable reports the issue to Northwind Cloud

  2. TRA-2026-41 published

103 days from report to publication, against a 90-day policy.How we disclose