CVE-2026-115711
Awaiting Analysis Awaiting Analysis - Queue

Sensitive Data Exposure in Elastic Cloud Enterprise

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: Elastic

Description
Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). ECE stores runtime information about platform service containers in a location that lower-privileged platform components can read, and this information includes secrets from the container configuration. An attacker with access to the internal ECE platform services can obtain these secrets, which include role tokens. A role token can let the attacker add an unauthorized host to the installation with the roles of that token.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-115711
EUVD
EUVD-2026-112923

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Elastic Elastic Cloud Enterprise 1.0.0
Elastic Elastic Cloud Enterprise 4.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-538 The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Elastic Cloud Enterprise (ECE) storing runtime information about platform service containers in a location accessible to lower-privileged components. This data includes sensitive secrets like role tokens. An attacker with access to internal ECE services could exploit this to obtain credentials and potentially add unauthorized hosts with elevated privileges.

Detection Guidance

Check for unauthorized hosts in the ECE platform host list as an indicator of compromise. Review runtime data files in platform service container locations for exposed secrets like role tokens.

Impact Analysis

An attacker could gain access to sensitive credentials such as role tokens, allowing them to add unauthorized hosts to your ECE installation with elevated privileges. This could lead to further compromise of your infrastructure or data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR or HIPAA, which mandate protection of personal or health information. A breach could result in legal penalties or reputational damage.

Mitigation Strategies

Upgrade Elastic Cloud Enterprise to versions 3.8.6 or 4.2.1 or later. If unable to upgrade, revoke unnecessary persistent role tokens and use ephemeral tokens for future host additions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115711. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart