---
id: "CVE-2026-115709"
kind: "vulnerability"
aliases: ["CVE-2026-115709"]
title: "Elastic Cloud Enterprise: symlink flaw exposes other deployments' data on a host"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Elastic Cloud Enterprise", "fixed": ["3.8.6", "4.2.1"], "affected": ">= 2.6.0, <= 3.8.5; >= 4.0.0, <= 4.2.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["elastic-cloud-enterprise", "elasticsearch", "infrastructure", "multi-tenant", "self-hosted"]
not_affected_if: ["managed-hosting", "single-deployment-host"]
published_at: "2026-10-29T15:17:18+00:00"
first_seen_at: "2026-10-29T15:25:39+00:00"
updated_at: "2026-10-29T15:27:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115709", "first_seen_at": "2026-10-29T15:25:39+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T15:27:22+00:00"}]
---

# Elastic Cloud Enterprise: symlink flaw exposes other deployments' data on a host

Elastic Cloud Enterprise follows symbolic links when accessing files, so a local user can redirect file access. An attacker on the same host can read and lose data belonging to other deployments.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Elastic Cloud Enterprise affected >= 2.6.0, <= 3.8.5; >= 4.0.0, <= 4.2.0 fixed 3.8.6, 4.2.1

## How to check

Check your ECE version in the Cloud UI or on the hosts. Affected: 2.6.0 through 3.8.5, and 4.0.0 through 4.2.0. Most exposed: allocator hosts running more than one deployment, where deployment code (custom bundles or plugins) can run.

## Fix

Upgrade Elastic Cloud Enterprise to 3.8.6 (3.x line) or 4.2.1 (4.x line), or later. Elastic says there are no workarounds.

## Timeline

- 2026-10-29T15:25:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115709
- 2026-10-29T15:27:22+00:00 analyst — Read Elastic ESA-2026-216: affected 2.6.0-3.8.5 and 4.0.0-4.2.0, fixed 3.8.6 / 4.2.1, no workarounds, no IOCs. No exploitation or PoC found. Sibling ECE advisories ESA-2026-215/218/221/222 exist (other CVEs).

## Documents

- [advisory] Elastic ESA-2026-216: ECE 3.8.6 and 4.2.1 Security Update https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-216/391263

## From the sources

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_