{"id":"CVE-2026-115708","kind":"vulnerability","aliases":["CVE-2026-115708"],"related":[],"title":"Elastic Cloud Enterprise: symlink flaw allows auth bypass on shared hosts","description":"Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132).","summary":"Elastic Cloud Enterprise follows a symbolic link to a file it should not access, letting a local user reach files outside its intended path. An attacker can bypass authentication and change the configuration of other deployments on the same host.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Elastic Cloud Enterprise","fixed":["3.8.6","4.2.1"],"affected":">= 1.0.0, <= 3.8.5; >= 4.0.0, <= 4.2.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["elastic-cloud-enterprise","elasticsearch","infrastructure","multi-tenant","self-hosted","symlink"],"not_affected_if":["fixed-version","managed-hosting","single-deployment-per-allocator"],"how_to_check":"- Check your ECE version: affected are 1.0.0 to 3.8.5 and 4.0.0 to 4.2.0.\n- Check whether any allocator host runs more than one deployment; only those are exposed.\n- Check whether untrusted users can run code inside deployment containers (custom bundles, plugins).","fix":"Upgrade ECE to 3.8.6 (3.x and earlier) or 4.2.1 (4.x). No workarounds.","status":"open","published_at":"2026-10-29T15:17:17+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","triaged_at":"2026-10-29T15:26:31+00:00","updated_at":"2026-10-29T15:27:08+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-29T15:26:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Elastic Cloud Enterprise: symlink flaw allows auth bypass on shared hosts","impact":"high","summary":"Elastic Cloud Enterprise follows a symbolic link to a file it should not access, letting a local user reach files outside its intended path. An attacker can bypass authentication and change the configuration of other deployments on the same host.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["elastic-cloud-enterprise","self-hosted","elasticsearch"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local attacker bypasses authentication and changes other deployments' configuration","analyst_note":"Find the affected and fixed ECE versions and the vulnerable file path in the NVD entry or the Elastic advisory.","how_to_check":"- Check the installed Elastic Cloud Enterprise version against the affected ranges in the advisory (unknown)\n- Confirm whether more than one deployment runs on the same ECE host (unknown)","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Teams that run Elastic Cloud Enterprise on their own hosts, especially hosts running several deployments, are the ones exposed. The sources do not give the affected version ranges, the exact file path involved, or whether a managed Elastic Cloud service is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4134,"output_tokens":539,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed ECE versions and the vulnerable file path in the NVD entry or the Elastic advisory.","search":"'-115708':14A,17A '-132':111C '-2026':13A,16A '-59':83C 'access':47B,79C 'allow':6A 'attack':59B,109C 'auth':7A 'authent':62B,92C 'bypass':8A,61B,93C 'capec':110C 'chang':64B,96C 'cloud':2A,19A,23B,35B,86C 'configur':66B,99C 'cve':12A,15A 'cwe':82C 'deploy':69B,102C 'ece':88C 'elast':1A,22B,34B,85C 'elastic':18A 'elastic-cloud-enterpris':21B 'elasticsearch':25B 'enterpris':3A,24B,36B,87C 'enterprise':20A 'file':43B,53B,78C 'flaw':5A 'follow':37B,81C 'host':11A,32B,73B,106C 'improp':74C 'infrastructur':26B 'intend':56B 'lead':90C 'let':48B 'link':40B,75C,80C 'local':50B 'multi':28B 'multi-ten':27B 'outsid':54B 'path':57B 'reach':52B 'resolut':76C 'self':31B 'self-host':30B 'share':10A 'symbol':39B 'symlink':4A,33B,108C 'tenant':29B 'unauthor':95C 'user':51B 'via':107C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Elastic Cloud Enterprise on their own infrastructure with more than one deployment on the same allocator host. Exploitation needs an attacker who can already run code inside a deployment container, such as through custom bundles or plugins, or via another vulnerability. They could then bypass authentication and change other deployments' configuration. Single-deployment-per-allocator setups, and Elastic-managed Cloud, are not named as affected.","tier":"B","verified":{"fix":{"at":"2026-10-29T15:27:08Z","by":"analyst","doc":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-215/391262","run_id":1035},"products":{"at":"2026-10-29T15:27:08Z","by":"analyst","doc":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-215/391262","run_id":1035},"workarounds":{"at":"2026-10-29T15:27:08Z","by":"analyst","doc":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-215/391262","run_id":1035},"how_to_check":{"at":"2026-10-29T15:27:08Z","by":"analyst","doc":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-215/391262","run_id":1035},"who_affected":{"at":"2026-10-29T15:27:08Z","by":"analyst","doc":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-215/391262","run_id":1035}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security@elastic.co","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115708","severity":null,"published_at":"2026-10-29T15:17:17+00:00","modified_at":"2026-10-29T15:17:17+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","fetched_at":"2026-10-29T15:25:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115708:1035","url":null,"severity":null,"published_at":"2026-10-29T15:27:08+00:00","modified_at":"2026-10-29T15:27:08+00:00","first_seen_at":"2026-10-29T15:27:08+00:00","fetched_at":"2026-10-29T15:27:08+00:00","note":"Read Elastic ESA-2026-215: affected ECE 1.0.0-3.8.5 and 4.0.0-4.2.0, fixed 3.8.6/4.2.1, no workarounds. Vulnerable file path not published. No exploitation or PoC seen; X not searched."}],"documents":[{"id":17397,"url":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-215/391262","title":"ESA-2026-215 ECE 3.8.6 and 4.2.1 Security Update","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}