CVE-2026-115708: Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass
Published Oct 29, 2026
·Updated
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132).
Event History
Oct 29, 2026
CVE Published
via MITRE·02:10 PM
Data Sourced
via MITRE·02:10 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access would an attacker need?
The CVSS vector indicates that exploitation requires local access and high privileges. It also has high attack complexity and does not require user interaction.
2
What is the likely scope of impact in a shared-host deployment?
The issue can enable unauthorized configuration changes affecting other ECE deployments located on the same host. The reported impact includes high confidentiality and integrity impact, with no availability impact indicated.
3
Which ECE releases are named in the related security update reference?
The reference names Elastic Cloud Enterprise 3.8.6 and 4.2.1.