{"id":"CVE-2026-119317","kind":"vulnerability","aliases":["CVE-2026-119317"],"related":[],"title":"Nessus on Linux: low-privileged scan users can read arbitrary text files","description":"On Linux, an authenticated, low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd process by running a custom Unix compliance audit against the scanner itself.","summary":"On Linux, a Nessus user with scan-creation rights can run a custom Unix compliance audit against the scanner itself and read arbitrary text files on the host. The reads run with the privileges of the nessusd process, so the attacker gets local file contents the account should not see.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux","nessus","self-hosted"],"not_affected_if":["admin-only-scan-creation","windows-scanner"],"how_to_check":"- Check the installed Nessus version on the scanner host (unknown exact command from sources)\n- Review which accounts hold scan-creation rights in Nessus\n- Look for custom Unix compliance audit files in use against the scanner host itself","fix":null,"status":"open","published_at":"2026-10-29T22:17:01+00:00","first_seen_at":"2026-10-29T22:27:06+00:00","triaged_at":"2026-10-29T22:28:49+00:00","updated_at":"2026-10-29T22:28:49+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-29T22:28:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Nessus on Linux: low-privileged scan users can read arbitrary text files","impact":"medium","summary":"On Linux, a Nessus user with scan-creation rights can run a custom Unix compliance audit against the scanner itself and read arbitrary text files on the host. The reads run with the privileges of the nessusd process, so the attacker gets local file contents the account should not see.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["nessus","linux","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local text files on the scanner host readable by the attacker","analyst_note":"Find the affected and fixed Nessus version ranges and the vendor advisory, which the NVD entry alone does not give.","how_to_check":"- Check the installed Nessus version on the scanner host (unknown exact command from sources)\n- Review which accounts hold scan-creation rights in Nessus\n- Look for custom Unix compliance audit files in use against the scanner host itself","plain_action":"","needs_analyst":true,"not_affected_if":["windows-scanner","admin-only-scan-creation"],"who_is_affected":"Teams running Tenable Nessus on Linux where some users have scan-creation rights. The exposure depends on whether those users can author or run custom Unix compliance audits that target the scanner host. Installations on other operating systems, or where scan creation is restricted to trusted admins, are less exposed; the sources do not say which versions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4105,"output_tokens":573,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119317':16A,19A '-2026':15A,18A 'account':73B 'arbitrari':11A,49B,93C 'attack':67B 'audit':42B,113C 'authent':80C 'complianc':41B,112C 'content':71B 'could':91C 'creation':34B,89C 'custom':39B,110C 'cve':14A,17A 'file':13A,51B,70B,95C 'get':68B 'host':25B,54B,99C 'infrastructur':20B 'linux':3A,21B,27B,78C 'local':69B 'low':5A,82C 'low-privileg':4A,81C 'nessus':1A,22B,29B,84C 'nessusd':63B,105C 'privileg':6A,60B,83C,102C 'process':64B,106C 'read':10A,48B,56B,92C 'right':35B,90C 'run':37B,57B,108C 'scan':7A,33B,88C 'scan-creat':32B,87C 'scanner':45B,98C,116C 'see':76B 'self':24B 'self-host':23B 'text':12A,50B,94C 'unix':40B,111C 'user':8A,30B,85C","nicknames":[],"mitigations":[],"who_affected":"Teams running Tenable Nessus on Linux where some users have scan-creation rights. The exposure depends on whether those users can author or run custom Unix compliance audits that target the scanner host. Installations on other operating systems, or where scan creation is restricted to trusted admins, are less exposed; the sources do not say which versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T22:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vulnreport@tenable.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119317","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119317","severity":null,"published_at":"2026-10-29T22:17:01+00:00","modified_at":"2026-10-29T22:17:01+00:00","first_seen_at":"2026-10-29T22:27:06+00:00","fetched_at":"2026-10-29T22:27:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}