Kibana 8.x < 8.19.20 / 9.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-92 / ESA-2026-98 / ESA-2026-100 / ESA-2026-104 / ESA-2026-105 / ESA-2026-106 / ESA-2026-110)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338743);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id(
    "CVE-2026-72650",
    "CVE-2026-72651",
    "CVE-2026-72655",
    "CVE-2026-72659",
    "CVE-2026-72663",
    "CVE-2026-72667",
    "CVE-2026-72675"
  );
  script_xref(name:"IAVB", value:"2026-B-0232");

  script_name(english:"Kibana 8.x < 8.19.20 / 9.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-92 / ESA-2026-98 / ESA-2026-100 / ESA-2026-104 / ESA-2026-105 / ESA-2026-106 / ESA-2026-110)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Kibana installed on the remote host is 8.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore,
affected by multiple vulnerabilities as referenced in the ESA-2026-92, ESA-2026-98, ESA-2026-100, ESA-2026-104,
ESA-2026-105, ESA-2026-106 and ESA-2026-110 advisories.

  - Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized
    data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch
    operations with elevated internal permissions and relies on a per-request space filter to keep the machine
    learning data of one space separated from another. Part of the Machine Learning functionality did not apply
    that filter, so operations issued from one space were carried out against the machine learning data of
    every space in the deployment. (CVE-2026-72675)

  - Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via
    Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the alerting feature
    could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive
    resources. A single request is sufficient to leave Kibana unable to serve requests for all users until the
    process is restarted. (CVE-2026-72651)

  - Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via
    Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Kibana
    visualization feature by an authenticated user holding only low-privileged access is not correctly
    validated before use. Processing the request causes unbounded memory growth in the Kibana process, which is
    terminated by the host once available memory is exhausted. Kibana then becomes unavailable to all users
    until the service is restarted. (CVE-2026-72659)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  # https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-92/389526
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?84923ccd");
  # https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-98/389516
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2c2c4e7f");
  # https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-100/389519
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bdf8d2c7");
  # https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-104/389520
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?571facd0");
  # https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-105/389521
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?dc24a6ef");
  # https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-106/389522
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6f400d16");
  # https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-110/389523
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4210dad2");
  script_set_attribute(attribute:"solution", value:
"Update to Kibana version 8.19.20, 9.4.5 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-72675");

  script_cwe_id(407, 639, 770, 862, 915);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:kibana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("kibana_web_detect.nbin");
  script_require_keys("installed_sw/Kibana");
  script_require_ports("Services/www", 5601);

  exit(0);
}

include('http.inc');
include('vcf.inc');

var app = 'Kibana';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:5601);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '8.0.0', 'fixed_version' : '8.19.20' },
  { 'min_version' : '9.0.0', 'fixed_version' : '9.4.5' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE
);