Kibana 9.1.x < 9.4.5 / 9.5.x < 9.5.1 Privilege Escalation (ESA-2026-128)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338734);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2026-72631");
  script_xref(name:"IAVB", value:"2026-B-0232");

  script_name(english:"Kibana 9.1.x < 9.4.5 / 9.5.x < 9.5.1 Privilege Escalation (ESA-2026-128)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a privilege escalation vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Kibana installed on the remote host is 9.1.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is,
therefore, affected by a vulnerability as referenced in the ESA-2026-128 advisory.

  - Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege
    Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that the
    integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolled in
    the corresponding agent policy. The resulting key allows new documents to be inserted and index mappings to
    be extended for specific indices. The key does not allow reading, updating, or deleting existing documents
    (CVE-2026-72631)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-128/389539
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?acf9fca0");
  script_set_attribute(attribute:"solution", value:
"Update to Kibana version 9.4.5, 9.5.1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-72631");

  script_cwe_id(269);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:kibana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("kibana_web_detect.nbin");
  script_require_keys("installed_sw/Kibana");
  script_require_ports("Services/www", 5601);

  exit(0);
}

include('http.inc');
include('vcf.inc');

var app = 'Kibana';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:5601);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '9.1.0', 'fixed_version' : '9.4.5' },
  { 'min_version' : '9.5.0', 'fixed_version' : '9.5.1' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_WARNING
);