---
id: "CVE-2026-115713"
kind: "vulnerability"
aliases: ["CVE-2026-115713"]
title: "Elastic Cloud Enterprise: symlink flaw exposes other deployments' data on a host"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Elastic Cloud Enterprise", "fixed": ["4.2.1"], "affected": ">= 4.1.0, <= 4.2.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["elastic-cloud-enterprise", "elasticsearch", "enterprise-search", "infrastructure", "self-hosted"]
not_affected_if: ["ece-3.x", "ece-4.0.x", "managed-hosting", "no-enterprise-search"]
published_at: "2026-10-29T15:17:18+00:00"
first_seen_at: "2026-10-29T15:25:39+00:00"
updated_at: "2026-10-29T15:27:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115713", "first_seen_at": "2026-10-29T15:25:39+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T15:27:12+00:00"}]
---

# Elastic Cloud Enterprise: symlink flaw exposes other deployments' data on a host

Elastic Cloud Enterprise mishandles symbolic links before accessing files, letting one deployment be tricked into reading and writing another deployment's data on the same host. An attacker with a foothold on a shared host can reach data belonging to other tenants.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Elastic Cloud Enterprise affected >= 4.1.0, <= 4.2.0 fixed 4.2.1

## How to check

Check the ECE version in the Cloud UI/admin console. Versions 4.1.0 through 4.2.0 are affected; 3.x and 4.0.x are not. Then check whether any deployment includes an Enterprise Search instance; without one you are not exposed.

## Fix

Upgrade Elastic Cloud Enterprise to 4.2.1 or later. No workarounds exist.

## Timeline

- 2026-10-29T15:25:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115713
- 2026-10-29T15:27:12+00:00 analyst — Read Elastic ESA-2026-222: affected ECE 4.1.0-4.2.0, fixed 4.2.1, no workarounds; only ECE with Enterprise Search instance and attacker already running code in its container. No exploitation reported.

## Documents

- [advisory] ECE 4.2.1 Security Update (ESA-2026-222) https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-4-2-1-security-update-esa-2026-222/391266

## From the sources

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_