Chainguard: multiple kibana-9.3 packages: security update to 9.3.8-r7

medium Tenable Cloud Security Plugin ID 476576

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the
Model Context Protocol. Prior to 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in
@modelcontextprotocol/client, the HTTP client transports and OAuth client requests followed redirects to a
different origin while retaining custom request headers and, for HTTP 307 or 308 responses, request
bodies. The affected surfaces are StreamableHTTPClientTransport, SSEClientTransport, and OAuth client
functions such as auth(). The trigger is an HTTP redirect to another origin. Custom headers and mcp-
session-id can be re-sent to the redirected origin. HTTP 307 and 308 redirects can also re-send the
request body. OAuth request bodies can contain refresh_token and client_secret values. Current runtimes
already strip the Authorization header across origins. stdio clients do not use the affected HTTP path. A
malicious or compromised MCP or authorization server could therefore receive API keys, session
identifiers, OAuth refresh tokens, or OAuth client secrets. Restoring unrestricted redirect following
after upgrading restores the exposure. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and
@modelcontextprotocol/client 2.3.0. (CVE-2026-111769)

Solution

Update the kibana-9.3 library and its related packages to version 9.3.8-r7 or later.

Plugin Details

Severity: Medium

ID: 476576

Version: Revision 1.2

Type: Local

Family: Chainguard Local Security Checks

Published: 10/22/2026

Updated: 11/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.43

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:P/A:N

CVSS Score Source: CVE-2026-111769

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/20/2026

Reference Information

CVE: CVE-2026-111769

Detections

Analytics