CVE-2026-115707
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Insertion of Sensitive Information into an Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation. After the ECE certificate rotation procedure runs, retained data contains platform credentials and certificate authority private keys readable by lower-privileged components.
Risk Assessment
An attacker controlling any host in the installation can use this data to gain full control of the ECE control plane and the deployments it manages.
Recommendation
Update ECE to a patched version, remove leftover data from certificate rotation, and restrict access to platform components.
Other vulnerabilities in Elastic Cloud Enterprise
See all- CVE-2025-37729Critical
Improper neutralization of special elements in the template engine of Elastic Cloud Enterprise (ECE) allows an admin-level actor to exfiltrate sensitive information and issue commands via a specially crafted string where Jinjava variables are evaluated.
- CVE-2026-115713High
Improper Link Resolution Before File Access (CWE-59) in Elastic Cloud Enterprise (ECE) allows a symlink attack (CAPEC-132). This can lead to unauthorized read and write access to data of other deployments on the same host.
- CVE-2026-115712Medium
Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) allows an authenticated user with read-only access to change an installation-wide account setting that only platform administrators should be permitted to change.
- CVE-2026-115711Medium
Insertion of Sensitive Information into an Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure. ECE stores runtime information about platform service containers in a location readable by lower-privileged components, and this data includes secrets from container configuration, including role tokens.
- CVE-2026-115709High
Improper Link Resolution Before File Access (CWE-59) in Elastic Cloud Enterprise (ECE) allows a symlink attack (CAPEC-132). This can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host.
- CVE-2026-115708High
Improper Link Resolution Before File Access (CWE-59) in Elastic Cloud Enterprise (ECE) allows a symlink attack (CAPEC-132). This can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host.
- CVE-2026-115706Medium
Authorization Bypass Through a User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation. An attacker who controls any host in an ECE installation can obtain credentials reserved for other platform roles.
- CVE-2025-37736High
Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The affected APIs include operations on service accounts, users, and API keys.
Original NVD description (English source)
Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lower-privileged platform components can read this data. An attacker who controls any host in the installation can use this data to get full control of the ECE control plane and of the deployments that it manages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS