5.4
Medium
CVE-2026-78609 Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via…
Description
Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eck Operator 2.6 | 2.6.0 → 3.4.1 | No fix stated |
References
- discuss.elastic.co discuss.elastic.co
Timeline
- Published
- Last modified
Other CVEs of Eck Operator
The 4 CVEs of Eck Operator →
CVE-2026-78600
Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse…
3.5
Low
CVE-2026-72640
The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it…
6.5
Medium
CVE-2026-72648
Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can…
6.5
Medium