{"id":"CVE-2026-115713","kind":"vulnerability","aliases":["CVE-2026-115713"],"related":[],"title":"Elastic Cloud Enterprise: symlink flaw exposes other deployments' data on a host","description":"Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132).","summary":"Elastic Cloud Enterprise mishandles symbolic links before accessing files, letting one deployment be tricked into reading and writing another deployment's data on the same host. An attacker with a foothold on a shared host can reach data belonging to other tenants.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Elastic Cloud Enterprise","fixed":["4.2.1"],"affected":">= 4.1.0, <= 4.2.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["elastic-cloud-enterprise","elasticsearch","enterprise-search","infrastructure","self-hosted"],"not_affected_if":["ece-3.x","ece-4.0.x","managed-hosting","no-enterprise-search"],"how_to_check":"Check the ECE version in the Cloud UI/admin console. Versions 4.1.0 through 4.2.0 are affected; 3.x and 4.0.x are not. Then check whether any deployment includes an Enterprise Search instance; without one you are not exposed.","fix":"Upgrade Elastic Cloud Enterprise to 4.2.1 or later. No workarounds exist.","status":"open","published_at":"2026-10-29T15:17:18+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","triaged_at":"2026-10-29T15:26:30+00:00","updated_at":"2026-10-29T15:27:12+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-29T15:26:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Elastic Cloud Enterprise: symlink flaw exposes other deployments' data on a host","impact":"high","summary":"Elastic Cloud Enterprise mishandles symbolic links before accessing files, letting one deployment be tricked into reading and writing another deployment's data on the same host. An attacker with a foothold on a shared host can reach data belonging to other tenants.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["elastic-cloud-enterprise","self-hosted","elasticsearch"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads and writes other deployments' data on the same host","analyst_note":"Check the NVD entry and Elastic's ESA advisory for affected and fixed ECE versions, and the exact precondition for the symlink attack.","how_to_check":"- Confirm whether Elastic Cloud Enterprise (ECE) is installed on the host, for example by checking the ECE version in the admin console.\n- Check the installed ECE version against the fixed versions listed by the vendor.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Teams that run Elastic Cloud Enterprise on their own hardware, where several deployments share one host. Hosted Elastic Cloud customers are not exposed through this flaw. The sources do not name affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":4126,"output_tokens":553,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Elastic's ESA advisory for affected and fixed ECE versions, and the exact precondition for the symlink attack.","search":"'-115713':15A,18A '-132':112C '-2026':14A,17A '-59':85C 'access':41B,81C,98C 'anoth':52B 'attack':61B,110C 'belong':72B 'capec':111C 'cloud':2A,20A,24B,35B,88C 'cve':13A,16A 'cwe':84C 'data':9A,55B,71B,100C 'deploy':8A,45B,53B,103C 'ece':90C 'elast':1A,23B,34B,87C 'elastic':19A 'elastic-cloud-enterpris':22B 'elasticsearch':26B 'enterpris':3A,25B,28B,36B,89C 'enterprise':21A 'enterprise-search':27B 'expos':6A 'file':42B,80C 'flaw':5A 'follow':83C 'foothold':64B 'host':12A,33B,59B,68B,107C 'improp':76C 'infrastructur':30B 'lead':92C 'let':43B 'link':39B,77C,82C 'mishandl':37B 'one':44B 'reach':70B 'read':49B,95C 'resolut':78C 'search':29B 'self':32B 'self-host':31B 'share':67B 'symbol':38B 'symlink':4A,109C 'tenant':75B 'trick':47B 'unauthor':94C 'via':108C 'write':51B,97C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Elastic Cloud Enterprise 4.1.0 to 4.2.0 that has deployments with an Enterprise Search instance. Exploitation needs an attacker who can already run code inside that Enterprise Search container, and then lets them read and write other deployments' data on the same host. ECE 3.x and 4.0.x, ECE without Enterprise Search, and Elastic's hosted cloud can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-29T15:27:12Z","by":"analyst","doc":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-4-2-1-security-update-esa-2026-222/391266","run_id":1033},"products":{"at":"2026-10-29T15:27:12Z","by":"analyst","doc":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-4-2-1-security-update-esa-2026-222/391266","run_id":1033},"workarounds":{"at":"2026-10-29T15:27:12Z","by":"analyst","doc":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-4-2-1-security-update-esa-2026-222/391266","run_id":1033},"how_to_check":{"at":"2026-10-29T15:27:12Z","by":"analyst","doc":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-4-2-1-security-update-esa-2026-222/391266","run_id":1033},"who_affected":{"at":"2026-10-29T15:27:12Z","by":"analyst","doc":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-4-2-1-security-update-esa-2026-222/391266","run_id":1033}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security@elastic.co","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115713","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115713","severity":null,"published_at":"2026-10-29T15:17:18+00:00","modified_at":"2026-10-29T15:17:18+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","fetched_at":"2026-10-29T15:25:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115713:1033","url":null,"severity":null,"published_at":"2026-10-29T15:27:12+00:00","modified_at":"2026-10-29T15:27:12+00:00","first_seen_at":"2026-10-29T15:27:12+00:00","fetched_at":"2026-10-29T15:27:12+00:00","note":"Read Elastic ESA-2026-222: affected ECE 4.1.0-4.2.0, fixed 4.2.1, no workarounds; only ECE with Enterprise Search instance and attacker already running code in its container. No exploitation reported."}],"documents":[{"id":17396,"url":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-4-2-1-security-update-esa-2026-222/391266","title":"ECE 4.2.1 Security Update (ESA-2026-222)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}