{"id":"CVE-2026-115706","kind":"vulnerability","aliases":["CVE-2026-115706"],"related":[],"title":"Elastic Cloud Enterprise: authorization bypass lets a host gain platform credentials","description":"Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.","summary":"Elastic Cloud Enterprise has an authorization bypass where a user-controlled key lets an attacker obtain credentials reserved for other platform roles. An attacker who controls any host in an installation can take full control of the ECE control plane and the deployments it manages.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elastic-cloud-enterprise","elasticsearch","infrastructure","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"- Confirm whether you run Elastic Cloud Enterprise and note the installed version, which the sources do not give a range for","fix":null,"status":"open","published_at":"2026-10-29T15:17:17+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","triaged_at":"2026-10-29T15:26:31+00:00","updated_at":"2026-10-29T15:26:31+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-29T15:26:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Elastic Cloud Enterprise: authorization bypass lets a host gain platform credentials","impact":"high","summary":"Elastic Cloud Enterprise has an authorization bypass where a user-controlled key lets an attacker obtain credentials reserved for other platform roles. An attacker who controls any host in an installation can take full control of the ECE control plane and the deployments it manages.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["elastic-cloud-enterprise","self-hosted","elasticsearch"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker gains full control of the ECE control plane and deployments","analyst_note":"Find the affected and fixed ECE versions and any mitigation in the NVD entry or Elastic's advisory, linked from https://nvd.nist.gov/vuln/detail/CVE-2026-115706.","how_to_check":"- Confirm whether you run Elastic Cloud Enterprise and note the installed version, which the sources do not give a range for\n- unknown for any specific file or setting to inspect; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Organisations that self-host Elastic Cloud Enterprise to run Elasticsearch and related deployments. The risk comes from any host inside the ECE installation being able to obtain credentials for other roles. The sources do not name affected versions, so teams should check their own ECE version against Elastic's advisory.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000713,"input_tokens":4178,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115706':14A,17A '-122':96C '-2026':13A,16A '-639':81C 'abus':94C 'attack':42B,51B,98C,122C 'author':4A,32B,73C 'bypass':5A,33B,74C 'capec':95C 'cloud':2A,20B,28B,84C 'control':38B,53B,62B,66B,78C,100C,124C,128C 'credenti':11A,44B,109C,118C 'cve':12A,15A 'cwe':80C 'deploy':70B,133C 'ece':65B,86C,105C,127C 'elast':1A,19B,27B,83C 'elastic-cloud-enterpris':18B 'elasticsearch':22B 'enterpris':3A,21B,29B,85C 'escal':91C 'full':61B,123C 'gain':9A 'give':120C 'host':8A,26B,55B,102C 'infrastructur':23B 'instal':58B,106C 'key':39B,79C 'lead':88C 'let':6A,40B 'manag':72B,136C 'obtain':43B,108C 'plane':67B,129C 'platform':10A,48B,115C 'privileg':90C,93C 'reserv':45B,112C 'role':49B,116C 'self':25B 'self-host':24B 'take':60B 'user':37B,77C 'user-control':36B,76C 'via':92C","nicknames":[],"mitigations":[],"who_affected":"Organisations that self-host Elastic Cloud Enterprise to run Elasticsearch and related deployments. The risk comes from any host inside the ECE installation being able to obtain credentials for other roles. The sources do not name affected versions, so teams should check their own ECE version against Elastic's advisory.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@elastic.co","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115706","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115706","severity":null,"published_at":"2026-10-29T15:17:17+00:00","modified_at":"2026-10-29T15:17:17+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","fetched_at":"2026-10-29T15:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}