SB2026103037 - Multiple vulnerabilities in Elastic Cloud Enterprise

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026103037

SB2026103037 - Multiple vulnerabilities in Elastic Cloud Enterprise

Published: October 30, 2026

Security Bulletin ID SB2026103037
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Link following (CVE-ID: CVE-2026-115713)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to read and modify data belonging to other deployments on the same host without authorization.

The vulnerability exists due to improper link resolution before file access in Elastic Cloud Enterprise (ECE) when accessing files through symbolic links. A local privileged user can use existing code execution inside an Enterprise Search instance container to carry out a symbolic link attack to gain unauthorized read and write access to data belonging to other deployments on the same host.


2) Incorrect authorization (CVE-ID: CVE-2026-115712)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify an installation-wide account setting without authorization.

The vulnerability exists due to incorrect authorization in the platform settings functionality of Elastic Cloud Enterprise (ECE) when handling requests to change an installation-wide account setting. A remote user can use read-only platform access to invoke functionality reserved for platform administrators to modify that setting.


3) File And Directory Information Exposure (CVE-ID: CVE-2026-115711)

CWE-ID: CWE-538 - File And Directory Information Exposure

CVSSv4: 7.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user on the local network to disclose container configuration secrets, including role tokens, and add unauthorized hosts to an Elastic Cloud Enterprise installation with the roles granted by those tokens.

The vulnerability exists due to insertion of sensitive information into an externally accessible file or directory in Elastic Cloud Enterprise's runtime information storage when storing platform service container configuration. A remote privileged user on the local network can access internal ECE platform services and read runtime information exposed to lower-privileged platform components to obtain secrets and use disclosed role tokens to add unauthorized hosts.


4) Link following (CVE-ID: CVE-2026-115709)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to disclose and cause loss of data belonging to other deployments on the same host.

The vulnerability exists due to improper link resolution before file access in Elastic Cloud Enterprise when accessing files through symbolic links. A local privileged user can use specially crafted symbolic links to redirect file operations to disclose or destroy data belonging to other deployments on the same host.

Exploitation requires the ability to run code inside an Elasticsearch deployment container, for example through custom bundles or plugins, or through another vulnerability.


5) Link following (CVE-ID: CVE-2026-115708)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to bypass authentication and make unauthorized configuration changes to other deployments on the same allocator host.

The vulnerability exists due to improper link resolution before file access in Elastic Cloud Enterprise (ECE) when accessing files through symbolic links. A local privileged user can carry out a symlink attack from an Elasticsearch deployment container to bypass authentication and modify the configuration of other deployments on the same host.

Exploitation requires the ability to run code inside an Elasticsearch deployment container, for example through custom bundles or plugins, or through another vulnerability.


6) File And Directory Information Exposure (CVE-ID: CVE-2026-115707)

CWE-ID: CWE-538 - File And Directory Information Exposure

CVSSv4: 7.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user on the local network to escalate privileges and gain full control of the ECE control plane and the deployments it manages.

The vulnerability exists due to insertion of sensitive information into externally accessible files or directories in the Elastic Cloud Enterprise certificate rotation procedure when retaining rotation data readable by lower-privileged platform components. A remote privileged user on the local network can retrieve platform credentials and certificate authority private keys from this data to gain full control of the ECE control plane and its managed deployments.


7) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-115706)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user on the local network to escalate privileges and gain full control of the Elastic Cloud Enterprise control plane and the deployments it manages.

The vulnerability exists due to authorization bypass through a user-controlled key in Elastic Cloud Enterprise when accessing credentials reserved for platform roles. A remote privileged user on the local network can obtain credentials reserved for other platform roles to gain control of the control plane and its managed deployments.

Exploitation requires administrative access to at least one ECE host, which may run only the allocator role, or network access to internal ECE platform services.


Remediation

Install update from vendor's website.

References