Medium severity · published Oct 29, 2026
CVE-2026-115706
Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation
New
6.8
CVSS
–
EPSS
No
On KEV
Description
Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Elastic Cloud Enterprise · Elastic
1.0.0 through 3.8.5; 4.0.0 through 4.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115706
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115706
discuss.elastic.co
https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-211/391260
More from Elastic Cloud Enterprise
9.8
CVE-2024-37282
It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to create new API keys…
8.8
CVE-2025-37736
Elastic Cloud Enterprise Improper Authorization
8.2
CVE-2026-115709
Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss
7.5
CVE-2026-115713
Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification
7.5
CVE-2023-31418
Elasticsearch uncontrolled resource consumption