CVE-2026-78600: Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention
Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Low-privileged tenants in Elastic Cloud on Kubernetes environments with cross-namespace associations are the relevant exposure group. The issue arises when RBAC denies such an association but credentials from the attempted association persist.
What does an attacker need to exploit it?
An attacker needs low-privileged tenant access and a cross-namespace association that is denied by RBAC enforcement. They may then retain read access to the associated Elasticsearch cluster through credentials that were not cleaned up.
What is the impact of successful exploitation?
Successful exploitation can provide unauthorized read access to the associated Elasticsearch cluster. The provided severity vector indicates no integrity or availability impact.