Link following in Elastic Cloud Enterprise - CVE-2026-115713
Published: October 30, 2026
Vulnerability identifier: #VU158523
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-115713
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to read and modify data belonging to other deployments on the same host without authorization.
The vulnerability exists due to improper link resolution before file access in Elastic Cloud Enterprise (ECE) when accessing files through symbolic links. A local privileged user can use existing code execution inside an Enterprise Search instance container to carry out a symbolic link attack to gain unauthorized read and write access to data belonging to other deployments on the same host.
Affected software
Elastic Cloud Enterprise
How to mitigate CVE-2026-115713
Install security update from vendor's website.
Elastic Cloud Enterprise - update to 4.2.1