Link following in Elastic Cloud Enterprise - CVE-2026-115708
Published: October 30, 2026
Vulnerability identifier: #VU158527
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-115708
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to bypass authentication and make unauthorized configuration changes to other deployments on the same allocator host.
The vulnerability exists due to improper link resolution before file access in Elastic Cloud Enterprise (ECE) when accessing files through symbolic links. A local privileged user can carry out a symlink attack from an Elasticsearch deployment container to bypass authentication and modify the configuration of other deployments on the same host.
Exploitation requires the ability to run code inside an Elasticsearch deployment container, for example through custom bundles or plugins, or through another vulnerability.
Affected software
Elastic Cloud Enterprise
How to mitigate CVE-2026-115708
Install security update from vendor's website.
Elastic Cloud Enterprise - addressed in versions 3.8.6, 4.2.1