EUVD-2026-70053
GHSA-pr5w-c42r-pmjr
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
AC:H reflects the specific condition of a RBAC-denied cross-namespace association with credential persistence; S:C because impact crosses from ECK Operator into the Elasticsearch cluster namespace; C:L for read-only unauthorized access.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
1DescriptionCVE.org
Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.
AnalysisAI
Incomplete credential cleanup in Elastic Cloud on Kubernetes (ECK Operator) allows a low-privileged tenant to retain unauthorized read access to an associated Elasticsearch cluster after a cross-namespace association attempt has been denied by Kubernetes RBAC enforcement. The root cause is CWE-459: when RBAC rejects the cross-namespace binding, ECK fails to revoke the authentication credentials it provisioned, leaving them valid and usable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a multi-tenant ECK deployment where cross-namespace associations are possible and RBAC is used as a boundary. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.5 base score accurately reflects a constrained but real privilege abuse scenario: AC:H indicates specific conditions must align (cross-namespace association attempted, provisioned credentials not cleaned up after RBAC denial), and C:L captures that the unauthorized access is limited to read-only Elasticsearch data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ECK Operator to version 3.5.0, which resolves the incomplete cleanup of authentication credentials on RBAC-denied cross-namespace associations per vendor advisory ESA-2026-146 (https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-146/390106). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-459 – Incomplete Cleanup
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today