Elastic Cloud Enterprise CVE-2026-115711

Exploitation requires the attacker to already have access to the internal ECE platform services - i.e., control of a lower-privileged platform component that can read the location where ECE stores runtime information about platform service containers. The exposed data must include secrets from the container configuration, specifically a role token, for the follow-on 'add unauthorized host' impact to apply. Limiting factors: this is adjacent-network, not internet-facing (AV:A), and demands an existing high-privilege internal foothold (PR:H), so it cannot be triggered by an unauthenticated external attacker against a default deployment; it is a post-access escalation primitive. The complete fix is upgrading to ECE 3.8.6 or 4.2.1 as stated in the vendor advisory.

This is a moderate-severity, privilege-gated information-disclosure flaw rather than an urgent remote threat. The CVSS 3.1 vector (AV:A/AC:H/PR:H/UI:N/S:U, C:H/I:H/A:H, base 6.4) tells a consistent story: exploitation is not internet-facing but requires a foothold on the adjacent ECE internal network AND already-held high privileges (PR:H) - specifically access to the internal ECE platform services. No EPSS score was provided, the vulnerability is not in CISA KEV, and no public exploit was supplied; the only reference is Elastic's own advisory (ESA-2026-218), so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', which aligns with a real-but-not-emergency priority: the high confidentiality/integrity/availability impacts (secret/role-token disclosure that can let an attacker enroll an unauthorized host) are serious, but the PR:H + AV:A prerequisites sharply limit who can reach it. The main tension to flag: the C:H/I:H/A:H impact looks alarming in isolation, yet it is only reachable by an actor who already holds significant internal access, so the practical risk is post-compromise privilege/lateral-movement escalation inside an ECE installation, not initial external compromise. No EPSS was supplied to corroborate or contradict this; absence of EPSS/KEV is noted, not treated as evidence of safety.

An attacker who has already gained access to a lower-privileged ECE internal platform component reads the externally-accessible location where ECE stores runtime container information, which includes secrets from the container configuration such as role tokens. Using a recovered role token, the attacker enrolls an unauthorized host into the ECE installation with the roles granted by that token, escalating their foothold. No public exploit was identified at time of analysis; exploitation requires the adjacent-network, high-privilege position described in the CVSS vector.