Vulnerability Details CVE-2026-78609
Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 0.6%
CVSS Severity
CVSS v3 Score 5.4
References
Products affected by CVE-2026-78609
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.10.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.11.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.11.1
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.12.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.12.1
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.13.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.14.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.15.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.16.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.16.1
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.6.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.6.1
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.6.2
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.7.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.8
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:2.9.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.0.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.1.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.2.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.3.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.3.1
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.3.2
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.4.0
-
cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:3.4.1