CVE-2026-78609
MediumCVSS 5.4Summary
Incorrect Authorization in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized data modification via Metadata Spoofing. An actor with limited Kubernetes permissions in a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace.
Risk Assessment
Risk of data integrity breach and compromised trust in Elasticsearch communications, potentially leading to data interception or modification.
Recommendation
Update ECK to a patched version and restrict Kubernetes permissions to the minimum required for users.
Other vulnerabilities in Elastic Cloud on Kubernetes
See all- CVE-2026-78600Low
Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.
- CVE-2026-72648Medium
Cleartext storage of sensitive information in an environment variable in Elastic Cloud on Kubernetes (ECK) can lead to information disclosure. When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account token, the token is written into the generated workload specification in cleartext rather than being referenced from the Kubernetes Secret that ECK maintains for other credentials. Any principal able to read workload specifications in the affected namespace can read a live Elasticsearch credential, even when Kubernetes RBAC does not grant that principal access to Secrets.
Original NVD description (English source)
Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace.