CVE-2026-72648

Received Received - Intake

Cleartext Storage of Elasticsearch Credentials in ECK Fleet Server

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can lead to information disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account token, the token is written into the generated workload specification in cleartext rather than being referenced from the Kubernetes Secret that ECK maintains for the other credentials on the same path. Any principal able to read workload specifications in the affected namespace can therefore read a live Elasticsearch credential, even when Kubernetes RBAC does not grant that principal access to Secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72648

EUVD

EUVD-2026-58281

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	cloud_on_kubernetes	*
elastic	cloud_on_kubernetes	From 3.0.0 (inc) to 3.4.1 (inc)
elastic	cloud_on_kubernetes	3.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-526	The product uses an environment variable to store unencrypted sensitive information.

Attack-Flow Graph

Executive Summary

This vulnerability involves Elastic Cloud on Kubernetes (ECK) storing sensitive Elasticsearch service account tokens in cleartext within workload specifications instead of referencing them from Kubernetes Secrets. This occurs when ECK reconciles a Fleet Server resource that authenticates to Elasticsearch using a service account token. The flaw allows any principal with read access to workload specifications to access live credentials without needing explicit Secret permissions.

Detection Guidance

To detect this vulnerability, check for cleartext Elasticsearch service account tokens in workload specifications. Use commands like 'kubectl get pods -o yaml' to inspect pod specs for exposed tokens in environment variables or configurations. Look for tokens in fields like spec.containers.env.value or spec.initContainers.env.value.

Impact Analysis

The vulnerability can lead to unauthorized access to live Elasticsearch credentials. Any principal with read access to workload specifications in the affected namespace can retrieve and misuse these credentials, potentially compromising the Elasticsearch cluster and the data it contains.

Compliance Impact

This vulnerability may violate compliance requirements that mandate protection of sensitive data, such as GDPR and HIPAA. Storing credentials in cleartext increases the risk of data breaches, which could result in legal penalties, reputational damage, and failure to meet regulatory standards for data security.

Mitigation Strategies

Upgrade ECK to version 3.5.0 or later immediately. After upgrading, invalidate the affected service account token and generate a new one. Verify no tokens remain exposed in workload specifications by reviewing pod configurations.

Hi! I’m here to help you understand CVE-2026-72648. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70