Vulnerability Details CVE-2026-78600
Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 7.0%
CVSS Severity
CVSS v3 Score 3.5
References
Products affected by CVE-2026-78600
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.10.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.11.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.11.1
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.12.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.12.1
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.13.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.14.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.15.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.16.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.16.1
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.6.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.6.1
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.6.2
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.7.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.8
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.9.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.0.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.1.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.2.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.3.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.3.1
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.3.2
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.4.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.4.1