Authorization bypass through user-controlled key in Elastic Cloud Enterprise - CVE-2026-115706
Published: October 30, 2026
Vulnerability identifier: #VU158529
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-115706
CWE-ID: CWE-639
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user on the local network to escalate privileges and gain full control of the Elastic Cloud Enterprise control plane and the deployments it manages.
The vulnerability exists due to authorization bypass through a user-controlled key in Elastic Cloud Enterprise when accessing credentials reserved for platform roles. A remote privileged user on the local network can obtain credentials reserved for other platform roles to gain control of the control plane and its managed deployments.
Exploitation requires administrative access to at least one ECE host, which may run only the allocator role, or network access to internal ECE platform services.
Affected software
Elastic Cloud Enterprise
How to mitigate CVE-2026-115706
Install security update from vendor's website.
Elastic Cloud Enterprise - addressed in versions 3.8.6, 4.2.1