Detections
Analytics
Kibana 8.x < 8.19.20 / 9.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-87 / ESA-2026-88)
high Nessus Plugin ID 338741
Language:
Synopsis
The remote host is affected by multiple vulnerabilities.Description
The version of Kibana installed on the remote host is 8.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-87 and ESA-2026-88 advisories.- A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view. (CVE-2026-72670)
- A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jobs and data frame analytics jobs without the trained model privilege can therefore remove a trained model from a space. The model itself is not deleted and remains available in its other spaces, and the change can be reversed by a suitably privileged user. (CVE-2026-72671)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update to Kibana version 8.19.20, 9.4.5 or later.See Also
Plugin Details
Severity: High
ID: 338741
File Name: kibana_esa_2026_87.nasl
Version: 1.1
Type: Remote
Family: CGI abuses
Published: 8/21/2026
Updated: 8/21/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.3
Percentile: 50.97
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N
CVSS Score Source: CVE-2026-72670
CVSS v3
Risk Factor: High
Base Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Vulnerability Information
CPE: cpe:/a:elasticsearch:kibana
Required KB Items: installed_sw/Kibana
Patch Publication Date: 8/13/2026
Vulnerability Publication Date: 8/13/2026
Reference Information
CVE: CVE-2026-72670, CVE-2026-72671