3.5
Faible
CVE-2026-78600 Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse…
Description
Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Eck Operator 2.6 | 2.6.0 → 3.4.1 | Pas de correctif indiqué |
Références
- discuss.elastic.co discuss.elastic.co
Chronologie
- Publiée
- Dernière modification
Autres CVE de Eck Operator
Les 4 CVE de Eck Operator →
CVE-2026-78609
Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via…
5.4
Moyenne
CVE-2026-72640
The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it…
6.5
Moyenne
CVE-2026-72648
Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can…
6.5
Moyenne