EUVD-2026-58281
GHSA-994r-4f38-cvgv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Kubernetes API is network-accessible and requires low-privilege authentication; exposure is confidentiality-only with no write or availability impact.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
1DescriptionCVE.org
Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can lead to information disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account token, the token is written into the generated workload specification in cleartext rather than being referenced from the Kubernetes Secret that ECK maintains for the other credentials on the same path. Any principal able to read workload specifications in the affected namespace can therefore read a live Elasticsearch credential, even when Kubernetes RBAC does not grant that principal access to Secrets.
AnalysisAI
Cleartext token exposure in Elastic Cloud on Kubernetes allows any principal with namespace workload-spec read access to retrieve live Elasticsearch service account credentials. Affected deployments are those running Fleet Server resources configured to authenticate to Elasticsearch via service account tokens - ECK writes the token directly into the generated Pod specification in cleartext rather than referencing the Kubernetes Secret where other credentials are stored, bypassing an intentional RBAC boundary. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the confidentiality impact is high given that the exposed credential grants direct Elasticsearch data-plane access.
Technical ContextAI
Elastic Cloud on Kubernetes (ECK) is a Kubernetes operator (CPE: cpe:2.3:a:elastic:eck_operator) that automates the lifecycle management of Elasticsearch, Kibana, and related Elastic Stack components on Kubernetes. During reconciliation of a Fleet Server resource, ECK generates a workload specification - a Pod or Deployment manifest - and embeds the Elasticsearch service account token as a cleartext value directly within that spec rather than mounting it via a secretKeyRef reference to the Kubernetes Secret ECK already manages for other credentials on the same path. CWE-526 defines this root cause: sensitive data stored in environment variables or inline spec fields that are readable through the Kubernetes API by any principal with get or list rights on workload resources, entirely independently of whether that principal holds Secret read permissions. CAPEC-37 (Retrieve Embedded Sensitive Data) is the corresponding attack pattern, where an adversary enumerates resource manifests to extract credentials that should have been stored and accessed through a secrets management layer.
RemediationAI
Upgrade to ECK Operator 3.5.0, which resolves this token exposure per Elastic security advisory ESA-2026-113 at https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-113/389493. If an immediate upgrade is not possible, restrict Kubernetes RBAC in the affected namespace so that only explicitly trusted principals retain get and list rights on pods, deployments, and replicasets - this reduces the exposure surface without eliminating the root cause, and operators should be aware it may break observability tooling or admission controllers that rely on workload-spec enumeration. Regardless of patch timing, administrators should audit existing workload specifications for embedded tokens and rotate any Elasticsearch service account tokens that may have been visible in workload specs to invalidate any credentials that could have already been harvested.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today