[ CVE-2026-115706 · Published 29 Oct 2026 ]
Vulnerability in Elastic Cloud Enterprise
CVSS 6.8
EPSS <1%1 agency advisoryFix available
[ Description ]Official description
Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.
[ Fixes ]Fixes and patches
- Security bulletin: Elastic 391263Vendor patch or bulletin · CERT-FR · discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-secu, cited by CERT-FR CERTFR-2026-AVI-1419
- Security bulletin: Elastic 391264Vendor patch or bulletin · CERT-FR · discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-secu, cited by CERT-FR CERTFR-2026-AVI-1419
- Security bulletin: Elastic 391261Vendor patch or bulletin · CERT-FR · discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-secu, cited by CERT-FR CERTFR-2026-AVI-1419
- Security bulletin: Elastic 391262Vendor patch or bulletin · CERT-FR · discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-secu, cited by CERT-FR CERTFR-2026-AVI-1419
- Security bulletin: Elastic 391260Vendor patch or bulletin · CERT-FR · discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-secu, cited by CERT-FR CERTFR-2026-AVI-1419
- Security bulletin: Elastic 391265Vendor patch or bulletin · CERT-FR · discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-secu, cited by CERT-FR CERTFR-2026-AVI-1419
- Security bulletin: Elastic 391266Vendor patch or bulletin · CERT-FR · discuss.elastic.co/t/elastic-cloud-enterprise-ece-4-2-1-security-updat, cited by CERT-FR CERTFR-2026-AVI-1419
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1419
Multiple vulnerabilities in Elastic Cloud Enterprise Translated from French
Multiple vulnerabilities have been discovered in Elastic Cloud Enterprise. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality and a breach of data integrity.