Kibana 8.19.x < 8.19.20 / 9.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-126 / ESA-2026-127 / ESA-2026-129)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338731);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id(
    "CVE-2026-72629",
    "CVE-2026-72630",
    "CVE-2026-72632"
  );
  script_xref(name:"IAVB", value:"2026-B-0232");

  script_name(english:"Kibana 8.19.x < 8.19.20 / 9.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-126 / ESA-2026-127 / ESA-2026-129)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Kibana installed on the remote host is 8.19.x prior to 8.19.20, 9.x prior to 9.4.5, or 9.5.x prior to
9.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-126, ESA-2026-127 and
ESA-2026-129 advisories.

  - Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse
    (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration.
    When an existing integration policy was updated, that restriction was evaluated against the integration
    recorded on the stored policy rather than against the replacement integration supplied with the update. An
    authenticated user holding only the Elastic Defend endpoint policy management privilege was therefore able
    to convert an endpoint policy they administer into a policy for a different integration, and to supply that
    integration's configuration at the same time. (CVE-2026-72630)

  - Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation
    (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses
    of its agent listing capability, but that capability accepted caller-supplied filter expressions over the
    stored field that holds the value, and evaluated them with Kibana's own internal Elasticsearch privileges
    rather than the caller's. Because the number of matching agents is reported back to the caller, the
    difference between a matching and a non-matching filter formed a side channel from which the full API key
    value could be reconstructed one character at a time with a short sequence of requests. (CVE-2026-72632)

  - Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space
    access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result is disclosure of
    inference output from a trained model in a different space that the user is not authorized to list, read,
    or use, which exposes the behavior of a model. The same pattern also reached the deployment stop and
    deployment update operations, allowing an active trained model deployment in another space to be stopped or
    to have its allocated resources altered. (CVE-2026-72629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  # https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-126/389530
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?64ed0143");
  # https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-127/389531
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b7cdc296");
  # https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-129/389532
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?28797070");
  script_set_attribute(attribute:"solution", value:
"Update to Kibana version 8.19.20, 9.4.5, 9.5.1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-72629");

  script_cwe_id(203, 639, 863);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:kibana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("kibana_web_detect.nbin");
  script_require_keys("installed_sw/Kibana");
  script_require_ports("Services/www", 5601);

  exit(0);
}

include('http.inc');
include('vcf.inc');

var app = 'Kibana';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:5601);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '8.19.0', 'fixed_version' : '8.19.20' },
  { 'min_version' : '9.0.0', 'fixed_version' : '9.4.5' },
  { 'min_version' : '9.5.0', 'fixed_version' : '9.5.1' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE
);