CVE-2026-78600
EUVD-2026-7005302.09.2026, 15:17
Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| elastic | elastic_cloud_on_kubernetes | 2.6.0 ≤ 𝑥 < 3.5.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration