Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-218)

Announcements Security Announcements
1

Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). ECE stores runtime information about platform service containers in a location that lower-privileged platform components can read, and this information includes secrets from the container configuration. An attacker with access to the internal ECE platform services can obtain these secrets, which include role tokens. A role token can let the attacker add an unauthorized host to the installation with the roles of that token.

Affected Versions:

  • 1.x, 2.x and 3.x: All versions from 1.0.0 up to and including 3.8.5
  • 4.x: All versions from 4.0.0 up to and including 4.2.0

Affected Configurations:

  • All ECE installations on affected versions are affected. The risk is higher if hosts were added with persistent role tokens. Exploitation requires access to the internal ECE platform services from the network, or administrative access to a host in the installation. ECE hosts and the internal ECE network are intended to be accessible only to trusted administrators. This deployment model limits exposure to this vulnerability.

Solutions and Mitigations:

The issue is resolved in version 3.8.6 and 4.2.1.

The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.

After you upgrade all hosts, revoke the persistent role tokens that you no longer need. To add hosts in the future, use new role tokens, and prefer ephemeral role tokens.

For Users that Cannot Upgrade:

  • Revoke the persistent role tokens that you no longer need. To add hosts, use ephemeral role tokens.

Indicators of Compromise (IOC)

Hosts in the ECE platform host list that your organization did not add can indicate exploitation of this vulnerability.

Severity: CVSSv3.1: Medium ( 6.4 ) - CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE ID: CVE-2026-115711
Problem Type: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory
Impact: CAPEC-37 - Retrieve Embedded Sensitive Data