Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132).
Affected Versions:
- 4.x: All versions from 4.1.0 up to and including 4.2.0
Users on the 3.x release line, including 3.8.x, and on 4.0.x are not affected. The functionality that contains this vulnerability was introduced in 4.1.0 and is not present in earlier releases.
Affected Configurations:
- ECE deployments that include an Enterprise Search instance. Exploitation requires that an attacker can already run code inside the Enterprise Search instance container. Deployments without an Enterprise Search instance are not exposed.
Solutions and Mitigations:
The issue is resolved in version 4.2.1.
The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Severity: CVSSv3.1: High ( 7.5 ) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE ID: CVE-2026-115713
Problem Type: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Impact: CAPEC-132 - Symlink Attack