CVE-2026-78600
LowCVSS 3.5Summary
Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.
Risk Assessment
Risk of unauthorized access to Elasticsearch data by low-privileged users, potentially leading to data confidentiality breaches.
Recommendation
Update Elastic Cloud on Kubernetes to a version with security fixes and ensure credentials are properly cleaned after access denial.
Other vulnerabilities in Elastic Cloud on Kubernetes
See all- CVE-2026-78609Medium
Incorrect Authorization in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized data modification via Metadata Spoofing. An actor with limited Kubernetes permissions in a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace.
- CVE-2026-72648Medium
Cleartext storage of sensitive information in an environment variable in Elastic Cloud on Kubernetes (ECK) can lead to information disclosure. When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account token, the token is written into the generated workload specification in cleartext rather than being referenced from the Kubernetes Secret that ECK maintains for other credentials. Any principal able to read workload specifications in the affected namespace can read a live Elasticsearch credential, even when Kubernetes RBAC does not grant that principal access to Secrets.
Original NVD description (English source)
Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.