Link following in Elastic Cloud Enterprise - CVE-2026-115709
Published: October 30, 2026
Vulnerability identifier: #VU158526
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-115709
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to disclose and cause loss of data belonging to other deployments on the same host.
The vulnerability exists due to improper link resolution before file access in Elastic Cloud Enterprise when accessing files through symbolic links. A local privileged user can use specially crafted symbolic links to redirect file operations to disclose or destroy data belonging to other deployments on the same host.
Exploitation requires the ability to run code inside an Elasticsearch deployment container, for example through custom bundles or plugins, or through another vulnerability.
Affected software
Elastic Cloud Enterprise
How to mitigate CVE-2026-115709
Install security update from vendor's website.
Elastic Cloud Enterprise - addressed in versions 3.8.6, 4.2.1