Vulnerabilities

TI-2026-54649 CVE-2026-78600 · GHSA-pr5w-c42r-pmjr

Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention

LOW 17

Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122).

CVSS 3.1LOW 3.5 Network Low privileges No interaction EPSS 0.00284 Published 2026-09-02 No fix listed CWE-459

TI-2026-54658 CVE-2026-78609 · GHSA-h699-694r-9xxf

Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data

LOW 23

Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690).

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0015 Published 2026-09-02 No fix listed CWE-863

TI-2026-50879 CVE-2026-72640 · GHSA-vvr2-6gx7-cxv9

Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure

LOW 29

The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00375 Published 2026-08-13 No fix listed CWE-441

TI-2026-50886 CVE-2026-72648 · GHSA-994r-4f38-cvgv

Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on…

LOW 29

Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can lead to information disclosure via Retrieve Embedded Sensitive Data (CAPEC-37).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00426 Published 2026-08-13 No fix listed CWE-526

TI-2023-15034 CVE-2023-31416 · GHSA-f827-q6f2-jc9c

Elastic Cloud on Kubernetes (ECK) secret token configuration issue

LOW 30

Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00428 Published 2023-10-26 Fixed in 2.8 CWE-200

TI-2020-05658 CVE-2020-7010 · GHSA-vfp4-xx6m-7vf6

Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak…

MEDIUM 42

Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01435 Published 2020-06-03 Fixed in 1.1.0 CWE-335