3.5
Low
CVE-2026-78600 Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse…
Description
Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eck Operator 2.6 | 2.6.0 → 3.4.1 | No fix stated |
Other CVEs of Eck Operator
The 4 CVEs of Eck Operator →
CVE-2026-78609
Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via…
5.4
Medium
CVE-2026-72640
The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it…
6.5
Medium
CVE-2026-72648
Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can…
6.5
Medium