Detections
Analytics
Kibana 8.19.x < 8.19.20 / 9.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-126 / ESA-2026-127 / ESA-2026-129)
high Nessus Plugin ID 338731
Synopsis
The remote host is affected by multiple vulnerabilities.Description
The version of Kibana installed on the remote host is 8.19.x prior to 8.19.20, 9.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-126, ESA-2026-127 and ESA-2026-129 advisories.- Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration.
When an existing integration policy was updated, that restriction was evaluated against the integration recorded on the stored policy rather than against the replacement integration supplied with the update. An authenticated user holding only the Elastic Defend endpoint policy management privilege was therefore able to convert an endpoint policy they administer into a policy for a different integration, and to supply that integration's configuration at the same time. (CVE-2026-72630)
- Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expressions over the stored field that holds the value, and evaluated them with Kibana's own internal Elasticsearch privileges rather than the caller's. Because the number of matching agents is reported back to the caller, the difference between a matching and a non-matching filter formed a side channel from which the full API key value could be reconstructed one character at a time with a short sequence of requests. (CVE-2026-72632)
- Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result is disclosure of inference output from a trained model in a different space that the user is not authorized to list, read, or use, which exposes the behavior of a model. The same pattern also reached the deployment stop and deployment update operations, allowing an active trained model deployment in another space to be stopped or to have its allocated resources altered. (CVE-2026-72629)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update to Kibana version 8.19.20, 9.4.5, 9.5.1 or later.See Also
http://www.nessus.org/u?28797070
Plugin Details
Severity: High
ID: 338731
File Name: kibana_esa_2026_126.nasl
Version: 1.1
Type: Remote
Family: CGI abuses
Published: 8/21/2026
Updated: 8/21/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.5
Percentile: 51.8
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:P/A:N
CVSS Score Source: CVE-2026-72629
CVSS v3
Risk Factor: High
Base Score: 7.1
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Vulnerability Information
CPE: cpe:/a:elasticsearch:kibana
Required KB Items: installed_sw/Kibana
Patch Publication Date: 8/13/2026
Vulnerability Publication Date: 8/13/2026