CVE-2026-115708 PUBLISHED

Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass

Assigner: elastic
Reserved: 23.10.2026 Published: 29.10.2026 Updated: 29.10.2026

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132).

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
CVSS Score: 7.2

Attack Vector	Local	Scope	Changed
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Elastic
Product	Elastic Cloud Enterprise
Versions	Default: unaffected affected from 1.0.0 to 3.8.5 (incl.) affected from 4.0.0 to 4.2.0 (incl.)

References

https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-215/391262

Problem Types

CWE-59 Improper Link Resolution Before File Access ('Link Following') CWE

Impacts

CAPEC-132 Symlink Attack