---
id: CVE-2026-119317
title: Incorrect Authorization
summary: >-
  On Linux, an authenticated, low-privileged Nessus user with scan-creation
  rights could read arbitrary text files on the scanner host with the privileges
  of the nessusd process by running a custom Unix compliance audit against the
  scanner…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
vendor: 'Tenable, Inc.'
product: Plugin Feed
affected:
  - plugin_feed < 202610282338
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T17:06:57.763805Z'
published: '2026-10-29'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:07:23.004Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119317'
references:
  - url: 'https://www.tenable.com/security/tns-2026-33'
tags:
  - cve.org
epss: 0.00222
epssPercentile: 0.12799
ingestedAt: '2026-11-05T16:24:31.130Z'
---

## Overview

On Linux, an authenticated, low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd process by running a custom Unix compliance audit against the scanner itself.

## Affected

- `plugin_feed < 202610282338`

## Remediation

Tenable has released updates to Plugins to resolve the issue. The updates have been distributed via the Tenable plugin feed in Feed Serial Numbers equal to or greater than #202610282338.