---
id: "CVE-2026-119317"
kind: "vulnerability"
aliases: ["CVE-2026-119317"]
title: "Nessus on Linux: low-privileged scan users can read arbitrary text files"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux", "nessus", "self-hosted"]
not_affected_if: ["admin-only-scan-creation", "windows-scanner"]
published_at: "2026-10-29T22:17:01+00:00"
first_seen_at: "2026-10-29T22:27:06+00:00"
updated_at: "2026-10-29T22:28:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119317", "first_seen_at": "2026-10-29T22:27:06+00:00"}]
---

# Nessus on Linux: low-privileged scan users can read arbitrary text files

On Linux, a Nessus user with scan-creation rights can run a custom Unix compliance audit against the scanner itself and read arbitrary text files on the host. The reads run with the privileges of the nessusd process, so the attacker gets local file contents the account should not see.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Nessus version on the scanner host (unknown exact command from sources)
- Review which accounts hold scan-creation rights in Nessus
- Look for custom Unix compliance audit files in use against the scanner host itself

## Timeline

- 2026-10-29T22:27:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119317

## From the sources

On Linux, an authenticated, low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd process by running a custom Unix compliance audit against the scanner itself.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_