Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132).
Affected Versions:
- 1.x, 2.x and 3.x: All versions from 1.0.0 up to and including 3.8.5
- 4.x: All versions from 4.0.0 up to and including 4.2.0
Affected Configurations:
- ECE installations that run more than one deployment on the same allocator host. Exploitation requires that an attacker can run code inside an Elasticsearch deployment container, for example through custom bundles or plugins, or through another vulnerability.
Solutions and Mitigations:
The issue is resolved in version 3.8.6 and 4.2.1.
The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Severity: CVSSv3.1: High ( 7.2 ) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
CVE ID: CVE-2026-115708
Problem Type: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Impact: CAPEC-132 - Symlink Attack