Bug: exports.vulns() and exports.was() still send the vpr_v2_score filter, which the API removed on 2026-10-01

Open
  • Is something wrong?
#1,054 0 comments 0 reactions 0 assignees View on GitHub

@lanz is already working on this.

Since Oct 29, 2026.

  • #1055 by @lanz — open

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
python
Domain
api

Research direction

Start by reading the exports.vulns() and exports.was() implementations and their tests, which the issue identifies as the affected entry points. Check how export filters are assembled and how existing argument deprecations are handled; verify both methods translate vpr_v2_score, warn callers, and reject using it together with vpr_score. The linked open pull request indicates work is already underway.

Written by the indexing model from the issue text.

Description

Describe the bug

Tenable removed the vpr_v2_score filter from the Vulnerability Management and Web App Scanning export APIs on 2026-10-01. pyTenable still accepts vpr_v2_score in tio.exports.vulns() and tio.exports.was() and sends it in the request, so every export that uses it now fails:

tenable.errors.BadRequestError: [400: POST] https://cloud.tenable.com/vulns/export
  body=b'{"code":"BAD_REQUEST_UNKNOWN_PROPERTY","message":"Unknown property \'vpr_v2_score\' detected in the payload. ..."}'

Tenable announced the removal in three changelogs:

Date Changelog What it says
2026-04-17 Vulnerability Priority Rating: Transition to VPR Version 2 vpr_v2_score will be deprecated. Use vpr_score, which reflects the updated VPR model from July 1, 2026.
2026-06-24 Reminder: Vulnerability Priority Rating (VPR) Version 2 Transition on July 1 Reminder of the transition.
2026-09-10 Final Reminder: vpr_v2 Fields Removed from Exports on October 1 vpr_v2_score and plugin.vpr_v2 are removed from both export endpoints on 2026-10-01. vpr_score reflects the enhanced VPR model.

The Export vulnerabilities and Export findings reference pages no longer list vpr_v2_score, and both carry a caution note that it was removed.

To Reproduce

from tenable.io import TenableIO

tio = TenableIO(access_key='...', secret_key='...')
tio.exports.vulns(vpr_v2_score={'gte': 7.0})   # BadRequestError: 400 BAD_REQUEST_UNKNOWN_PROPERTY
tio.exports.was(vpr_v2_score={'gte': 7.0})     # same

Expected behavior

vpr_score now uses the same VPR v2 model that vpr_v2_score used, so existing scripts should keep working:

  • Translation: the vpr_v2_score argument is sent to the API as vpr_score, with a DeprecationWarning that tells callers to switch to vpr_score.
  • Both arguments: passing vpr_score and vpr_v2_score together raises a clear error.

Workaround

Pass the same value as vpr_score instead:

tio.exports.vulns(vpr_score={'gte': 7.0})

System Information:

  • OS: any
  • Architecture: any
  • Version: pyTenable 26.10.1 and earlier

Additional context

Confirmed against the live API in several environments: vpr_v2_score returns 400 BAD_REQUEST_UNKNOWN_PROPERTY for both vulnerability and WAS exports, while vpr_score is accepted.

Dominant language
Python
Stars
417
Forks
190
Avg merge
3d 22h
Merged PRs (30d)
7

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from tenable/pyTenable

All issues in tenable/pyTenable

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.