CVE-2026-115707

Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation

State: Published
Severity: 6.4 Medium
Published: Oct 29, 2026
Updated: Oct 30, 2026
Reserved: Oct 23, 2026

Read the record on cve.org

Description

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lower-privileged platform components can read this data. An attacker who controls any host in the installation can use this data to get full control of the ECE control plane and of the deployments that it manages.

Scores

CVSS	Score	Vector	Source
3.1	6.4 Medium	CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	elastic

Weaknesses

CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory

Affected Products

Product	Versions
Elastic Cloud EnterpriseElastic	2.6.0 through 3.8.5Affected 4.0.0 through 4.2.0Affected

References

https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-212/391261

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.