Detections
Analytics
Kibana 7.x / 8.x < 8.19.16 / 9.0.x < 9.3.5 / 9.4.x < 9.4.2 Path Traversal (ESA-2026-160)
high Nessus Plugin ID 344303
Synopsis
The remote host is affected by a path traversal vulnerability.Description
The version of Kibana installed on the remote host is 7.11.0 through 7.17.29, or 8.x prior to 8.19.16, or 9.0.x prior to 9.3.5, or 9.4.x prior to 9.4.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-160 advisory.- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag management interface to act on an unintended target, resulting in the deletion of privileged resources including administrative accounts and other organizational assets. Exploitation requires an administrator to interact with the affected interface. (CVE-2026-78592)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Update to Kibana version 8.19.16, 9.3.5, 9.4.2 or later. Note that no fix is available for the 7.x release branch;refer to the vendor advisory for details.
See Also
Plugin Details
Severity: High
ID: 344303
File Name: kibana_esa_2026_160.nasl
Version: 1.1
Type: Remote
Family: CGI abuses
Published: 9/9/2026
Updated: 9/9/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.44
CVSS v2
Risk Factor: High
Base Score: 8.5
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C
CVSS Score Source: CVE-2026-78592
CVSS v3
Risk Factor: High
Base Score: 7.3
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Vulnerability Information
CPE: cpe:/a:elasticsearch:kibana
Required KB Items: installed_sw/Kibana
Patch Publication Date: 9/1/2026
Vulnerability Publication Date: 9/1/2026
Reference Information
CVE: CVE-2026-78592
IAVB: 2026-B-0244