CVE-2026-115708

Improper neutralization of special elements in the template engine of Elastic Cloud Enterprise (ECE) allows an admin-level actor to exfiltrate sensitive information and issue commands via a specially crafted string where Jinjava variables are evaluated.

Improper Link Resolution Before File Access (CWE-59) in Elastic Cloud Enterprise (ECE) allows a symlink attack (CAPEC-132). This can lead to unauthorized read and write access to data of other deployments on the same host.

Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) allows an authenticated user with read-only access to change an installation-wide account setting that only platform administrators should be permitted to change.

Insertion of Sensitive Information into an Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure. ECE stores runtime information about platform service containers in a location readable by lower-privileged components, and this data includes secrets from container configuration, including role tokens.

Improper Link Resolution Before File Access (CWE-59) in Elastic Cloud Enterprise (ECE) allows a symlink attack (CAPEC-132). This can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host.

Insertion of Sensitive Information into an Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation. After the ECE certificate rotation procedure runs, retained data contains platform credentials and certificate authority private keys readable by lower-privileged components.

Authorization Bypass Through a User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation. An attacker who controls any host in an ECE installation can obtain credentials reserved for other platform roles.

Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The affected APIs include operations on service accounts, users, and API keys.