Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation
Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.
Affected Versions:
- 1.x, 2.x and 3.x: All versions from 1.0.0 up to and including 3.8.5
- 4.x: All versions from 4.0.0 up to and including 4.2.0
Affected Configurations:
- All ECE installations on affected versions are affected. Exploitation requires administrative access to at least one host in the ECE installation, including a host that only runs the allocator role, or access to the internal ECE platform services from the network. ECE hosts and the internal ECE network are intended to be accessible only to trusted administrators. This deployment model limits exposure to this vulnerability.
Solutions and Mitigations:
The issue is resolved in version 3.8.6 and 4.2.1.
The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.
For Users that Cannot Upgrade:
- There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Severity: CVSSv3.1: Medium ( 6.8 ) - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE ID: CVE-2026-115706
Problem Type: CWE-639 - Authorization Bypass Through User-Controlled Key
Impact: CAPEC-122 - Privilege Abuse