---
id: "CVE-2026-115708"
kind: "vulnerability"
aliases: ["CVE-2026-115708"]
title: "Elastic Cloud Enterprise: symlink flaw allows auth bypass on shared hosts"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Elastic Cloud Enterprise", "fixed": ["3.8.6", "4.2.1"], "affected": ">= 1.0.0, <= 3.8.5; >= 4.0.0, <= 4.2.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["elastic-cloud-enterprise", "elasticsearch", "infrastructure", "multi-tenant", "self-hosted", "symlink"]
not_affected_if: ["fixed-version", "managed-hosting", "single-deployment-per-allocator"]
published_at: "2026-10-29T15:17:17+00:00"
first_seen_at: "2026-10-29T15:25:39+00:00"
updated_at: "2026-10-29T15:27:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115708", "first_seen_at": "2026-10-29T15:25:39+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T15:27:08+00:00"}]
---

# Elastic Cloud Enterprise: symlink flaw allows auth bypass on shared hosts

Elastic Cloud Enterprise follows a symbolic link to a file it should not access, letting a local user reach files outside its intended path. An attacker can bypass authentication and change the configuration of other deployments on the same host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Elastic Cloud Enterprise affected >= 1.0.0, <= 3.8.5; >= 4.0.0, <= 4.2.0 fixed 3.8.6, 4.2.1

## How to check

- Check your ECE version: affected are 1.0.0 to 3.8.5 and 4.0.0 to 4.2.0.
- Check whether any allocator host runs more than one deployment; only those are exposed.
- Check whether untrusted users can run code inside deployment containers (custom bundles, plugins).

## Fix

Upgrade ECE to 3.8.6 (3.x and earlier) or 4.2.1 (4.x). No workarounds.

## Timeline

- 2026-10-29T15:25:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115708
- 2026-10-29T15:27:08+00:00 analyst — Read Elastic ESA-2026-215: affected ECE 1.0.0-3.8.5 and 4.0.0-4.2.0, fixed 3.8.6/4.2.1, no workarounds. Vulnerable file path not published. No exploitation or PoC seen; X not searched.

## Documents

- [advisory] ESA-2026-215 ECE 3.8.6 and 4.2.1 Security Update https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-215/391262

## From the sources

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_