5.4
Moyenne
CVE-2026-78609 Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via…
Description
Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Eck Operator 2.6 | 2.6.0 → 3.4.1 | Pas de correctif indiqué |
Références
- discuss.elastic.co discuss.elastic.co
Chronologie
- Publiée
- Dernière modification
Autres CVE de Eck Operator
Les 4 CVE de Eck Operator →
CVE-2026-78600
Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse…
3.5
Faible
CVE-2026-72640
The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it…
6.5
Moyenne
CVE-2026-72648
Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can…
6.5
Moyenne