CVE-2026-119317 in Plugin Feed
Summary
by MITRE • 10/29/2026
On Linux, an authenticated, low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd process by running a custom Unix compliance audit against the scanner itself.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability described constitutes a critical local privilege escalation and information disclosure flaw within the Tenable Nessus security scanning platform, specifically affecting Linux-based deployments where an authenticated user possesses scan-creation capabilities but lacks administrative privileges. This issue arises from improper validation of input parameters when executing custom Unix compliance audits against the scanner host itself. By crafting a specific audit script that targets local file system paths rather than remote systems or standard configuration checks, an attacker can exploit the execution context in which Nessus operates to read arbitrary text files on the underlying operating system. The severity of this flaw is compounded by the fact that it allows access only through legitimate authentication channels, meaning no unauthenticated network exploitation vector exists, yet it represents a significant insider threat risk or lateral movement opportunity if an attacker gains low-level account credentials within the Nessus environment.
From a technical perspective, the root cause lies in how the nessusd daemon processes compliance audit scripts submitted by users with specific permissions. When a user initiates a scan targeting the local scanner host, the system executes the provided audit logic under the security context of the nessusd process. Typically, this service runs with elevated privileges to facilitate deep system introspection and configuration analysis on remote targets. However, in this scenario, the application fails to restrict file access operations within these custom audits to a predefined safe directory or sandboxed environment. Consequently, any text-readable path accessible by the nessusd user account becomes readable through the audit output mechanism. This effectively bypasses standard operating system permission models because the attacker leverages the trusted execution context of the scanner service rather than attempting to break out via network protocols or buffer overflows.
The operational impact of this vulnerability is substantial, particularly in environments where Nessus serves as a centralized security management tool with multiple users having varying levels of access. An authenticated low-privileged user can extract sensitive configuration files, credential stores, private keys, and other proprietary data stored on the scanner host. This information disclosure can lead to further compromise of the infrastructure, such as decrypting encrypted communications or accessing database credentials embedded in configuration scripts. Furthermore, because the attack requires only scan creation rights, it is relatively easy for a malicious insider or an attacker who has compromised a low-level account to execute this exploit without triggering immediate alarms associated with administrative actions like user management or plugin updates.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-200: Information Exposure and CWE-732: Incorrect Permission Assignment for Critical Resource. The lack of proper access control checks on file read operations within the audit execution engine allows unauthorized data retrieval. Additionally, from a tactical standpoint as defined by MITRE ATT&CK, this behavior corresponds to T1083: File and Directory Discovery and potentially T1552.004: Unsecured Credentials if sensitive files containing passwords or keys are accessed. The attack vector is classified under Local Access with Low Privileges, indicating that while the initial foothold requires authentication, the subsequent privilege escalation occurs through misuse of existing permissions rather than exploiting a separate software bug in the kernel or network stack.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Tenable has addressed this issue by updating Nessus to enforce stricter sandboxing for compliance audits executed against local hosts, ensuring that file access is restricted to necessary directories only. Administrators should immediately apply the latest security patches provided by Tenable to close this gap. In addition to patching, organizations should implement strict role-based access control (RBAC) policies within Nessus, limiting scan-creation rights to trusted administrators or senior analysts who require such privileges for legitimate operational purposes. Regular auditing of user permissions and monitoring for unusual audit script submissions can also help detect potential exploitation attempts before significant data loss occurs.