CVE-2026-115713 PUBLISHED

Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification

Assigner: elastic
Reserved: 23.10.2026 Published: 29.10.2026 Updated: 29.10.2026

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132).

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 7.5

Attack Vector	Local	Scope	Changed
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Elastic
Product	Elastic Cloud Enterprise
Versions	Default: unaffected affected from 4.1.0 to 4.2.0 (incl.)

References

https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-4-2-1-security-update-esa-2026-222/391266

Problem Types

CWE-59 Improper Link Resolution Before File Access ('Link Following') CWE

Impacts

CAPEC-132 Symlink Attack