Vulnerability · Published Sep 2, 2026 · Assigned by elastic
CVE-2026-78600Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention
Low 3.5
In plain English
A low-severity security flaw in Eck Operator from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.3%top 79.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Eck Operator | 2.6.0 – through 3.4.1 |
Weakness: CWE-459 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N