Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).
Affected Versions:
- 2.x and 3.x: All versions from 2.6.0 up to and including 3.8.5
- 4.x: All versions from 4.0.0 up to and including 4.2.0
Affected Configurations:
- Exploitation requires that an attacker can run code inside an Elasticsearch deployment container, for example through custom bundles or plugins, or through another vulnerability.
Solutions and Mitigations:
The issue is resolved in version 3.8.6 and 4.2.1.
The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Severity: CVSSv3.1: High ( 8.2 ) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE ID: CVE-2026-115709
Problem Type: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Impact: CAPEC-132 - Symlink Attack