CVE-2026-78609: Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data

Published Sep 2, 2026

Updated

Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace.

Affected Software

1 affected component

Elastic Elastic Cloud on Kubernetes (ECK)

Event History

Sep 2, 2026

CVE Published

via MITRE·02:43 PM

Data Sourced

via MITRE·02:43 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An actor with limited Kubernetes permissions that are confined to a single namespace could exploit the authorization weakness.

What cross-namespace impact is possible?

The actor could cause attacker-controlled certificate material to be added to an Elasticsearch client trust bundle managed by ECK in a separate namespace.

What is the stated security impact?

The issue can result in unauthorized modification of data. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact.