Live › vulnerability › CVE-2026-115709
Elastic Cloud Enterprise follows symbolic links when accessing files, so a local user can redirect file access. An attacker on the same host can read and lose data belonging to other deployments.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Self-managed Elastic Cloud Enterprise installations on versions 2.6.0-3.8.5 or 4.0.0-4.2.0 that run several deployments on one host. Exploitation needs an attacker who can already run code inside an Elasticsearch deployment container (for example through custom bundles or plugins, or another vulnerability), who can then plant symlinks to read or destroy other deployments' data. Single-deployment hosts, and Elastic Cloud hosted by Elastic, are lower risk or can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Elastic Cloud Enterprise | vendor | >= 2.6.0, <= 3.8.5; >= 4.0.0, <= 4.2.0 | 3.8.6, 4.2.1 |
2.6.0 through 3.8.5, and 4.0.0 through 4.2.03.8.6 (3.x line) or 4.2.1 (4.x line), or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).
This page as .md · .json · in your agent: get_signal("CVE-2026-115709")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.