{"id":"CVE-2026-115709","kind":"vulnerability","aliases":["CVE-2026-115709"],"related":[],"title":"Elastic Cloud Enterprise: symlink flaw exposes other deployments' data on a host","description":"Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).","summary":"Elastic Cloud Enterprise follows symbolic links when accessing files, so a local user can redirect file access. An attacker on the same host can read and lose data belonging to other deployments.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Elastic Cloud Enterprise","fixed":["3.8.6","4.2.1"],"affected":">= 2.6.0, <= 3.8.5; >= 4.0.0, <= 4.2.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["elastic-cloud-enterprise","elasticsearch","infrastructure","multi-tenant","self-hosted"],"not_affected_if":["managed-hosting","single-deployment-host"],"how_to_check":"Check your ECE version in the Cloud UI or on the hosts. Affected: 2.6.0 through 3.8.5, and 4.0.0 through 4.2.0. Most exposed: allocator hosts running more than one deployment, where deployment code (custom bundles or plugins) can run.","fix":"Upgrade Elastic Cloud Enterprise to 3.8.6 (3.x line) or 4.2.1 (4.x line), or later. Elastic says there are no workarounds.","status":"open","published_at":"2026-10-29T15:17:18+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","triaged_at":"2026-10-29T15:26:32+00:00","updated_at":"2026-10-29T15:27:22+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-29T15:26:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Elastic Cloud Enterprise: symlink flaw exposes other deployments' data on a host","impact":"high","summary":"Elastic Cloud Enterprise follows symbolic links when accessing files, so a local user can redirect file access. An attacker on the same host can read and lose data belonging to other deployments.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["elastic-cloud-enterprise","self-hosted","elasticsearch"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker reads or loses data of other deployments","analyst_note":"Find affected and fixed ECE versions and check the Elastic advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-115709 for the vendor's fix and how to check exposure.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Teams that run Elastic Cloud Enterprise on their own hardware with several deployments sharing one host are the ones exposed. Elastic Cloud hosted services and single-deployment setups are not described as affected. The sources do not give affected version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000655,"input_tokens":4132,"output_tokens":483,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed ECE versions and check the Elastic advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-115709 for the vendor's fix and how to check exposure.","search":"'-115709':15A,18A '-132':102C '-2026':14A,17A '-59':75C 'access':41B,50B,71C 'attack':52B,100C 'belong':62B,90C 'capec':101C 'cloud':2A,20A,24B,35B,78C 'cve':13A,16A 'cwe':74C 'data':9A,61B,89C 'deploy':8A,65B,93C 'disclosur':85C 'ece':80C 'elast':1A,23B,34B,77C 'elastic':19A 'elastic-cloud-enterpris':22B 'elasticsearch':26B 'enterpris':3A,25B,36B,79C 'enterprise':21A 'expos':6A 'file':42B,49B,70C 'flaw':5A 'follow':37B,73C 'host':12A,33B,56B,97C 'improp':66C 'infrastructur':27B 'lead':82C 'link':39B,67C,72C 'local':45B 'lose':60B 'loss':87C 'multi':29B 'multi-ten':28B 'read':58B 'redirect':48B 'resolut':68C 'self':32B 'self-host':31B 'symbol':38B 'symlink':4A,99C 'tenant':30B 'unauthor':84C 'user':46B 'via':98C","nicknames":[],"mitigations":[],"who_affected":"Self-managed Elastic Cloud Enterprise installations on versions 2.6.0-3.8.5 or 4.0.0-4.2.0 that run several deployments on one host. Exploitation needs an attacker who can already run code inside an Elasticsearch deployment container (for example through custom bundles or plugins, or another vulnerability), who can then plant symlinks to read or destroy other deployments' data. Single-deployment hosts, and Elastic Cloud hosted by Elastic, are lower risk or can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-29T15:27:22Z","by":"analyst","doc":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-216/391263","run_id":1034},"products":{"at":"2026-10-29T15:27:22Z","by":"analyst","doc":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-216/391263","run_id":1034},"workarounds":{"at":"2026-10-29T15:27:22Z","by":"analyst","doc":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-216/391263","run_id":1034},"how_to_check":{"at":"2026-10-29T15:27:22Z","by":"analyst","doc":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-216/391263","run_id":1034},"who_affected":{"at":"2026-10-29T15:27:22Z","by":"analyst","doc":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-216/391263","run_id":1034}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security@elastic.co","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115709","severity":null,"published_at":"2026-10-29T15:17:18+00:00","modified_at":"2026-10-29T15:17:18+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","fetched_at":"2026-10-29T15:25:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115709:1034","url":null,"severity":null,"published_at":"2026-10-29T15:27:22+00:00","modified_at":"2026-10-29T15:27:22+00:00","first_seen_at":"2026-10-29T15:27:22+00:00","fetched_at":"2026-10-29T15:27:22+00:00","note":"Read Elastic ESA-2026-216: affected 2.6.0-3.8.5 and 4.0.0-4.2.0, fixed 3.8.6 / 4.2.1, no workarounds, no IOCs. No exploitation or PoC found. Sibling ECE advisories ESA-2026-215/218/221/222 exist (other CVEs)."}],"documents":[{"id":17398,"url":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-216/391263","title":"Elastic ESA-2026-216: ECE 3.8.6 and 4.2.1 Security Update","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}