CVE-2026-115706

MediumCVSS 6.8/10Last modified Oct 30, 2026

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
Elastic	Elastic Cloud Enterprise	>= 1.0.0, <= 3.8.5; >= 4.0.0, <= 4.2.0

References

https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-211/391260Vendor Advisory

Timeline

Published: Oct 29, 2026
Last modified: Oct 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1157076.4Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to priv CVE-2026-1157087.2Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass CVE-2026-1157098.2Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosur CVE-2026-115717.5The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing CVE-2026-1157104.2Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via CVE-2026-1157116.4Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to cred CVE-2026-1157124.3Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Acc CVE-2026-1157137.5Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and CVE-2026-1157147.4Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, CVE-2026-1157156.5Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input CVE-2026-1157166.5Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Pay CVE-2026-1157177.7Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks t