CVE-2026-115706 Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-115706?
CVE-2026-115706 is a medium-severity vulnerability in Elastic Cloud Enterprise, published on 29 Oct 2026.
Official description
Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.
Weakness: CWE-639
Which versions are affected by CVE-2026-115706?
How do I fix CVE-2026-115706?
No fix has been published for CVE-2026-115706 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-115706 being exploited?
There is no known exploitation of CVE-2026-115706 in the wild and no public exploit code.
Sources
Also known as GHSA-fmgj-xvwq-2gqq.