CVE-2026-78609 — Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data
Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited …
Published: 2026-09-02 · CVSS: 5.4 · CVSS 3.1
Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7