CVE-2026-78600

3.5 Faible

Publiée le 02/09/2026 à 17:17 · Modifiée le 03/09/2026 à 21:15 · Analysée par le NVD · Source : security@elastic.co

Description

Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.

Traduire en français

Produits concernés

Elastic Eck Operator
Elastic elastic cloud on kubernetes

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.5 Faible	security@elastic.co	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-459

Références

https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-146/390106 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories