Eck Operator
Monthly
Incomplete credential cleanup in Elastic Cloud on Kubernetes (ECK Operator) allows a low-privileged tenant to retain unauthorized read access to an associated Elasticsearch cluster after a cross-namespace association attempt has been denied by Kubernetes RBAC enforcement. The root cause is CWE-459: when RBAC rejects the cross-namespace binding, ECK fails to revoke the authentication credentials it provisioned, leaving them valid and usable. With CVSS 3.5 and scope-changed vector (S:C), the vendor advisory ESA-2026-146 identifies the fix in ECK 3.5.0.
Cross-namespace certificate injection in Elastic Cloud on Kubernetes (ECK) Operator allows a low-privileged Kubernetes user confined to one namespace to insert attacker-controlled TLS certificate material into an Elasticsearch client trust bundle managed by ECK in a separate, distinct namespace. The flaw exploits incorrect authorization (CWE-863) via metadata spoofing (CAPEC-690), violating the namespace isolation boundary that Kubernetes clusters rely on for tenant separation. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the low privilege bar and network-accessible Kubernetes API make this a realistic threat in multi-tenant cluster environments.
Cross-namespace secret exfiltration in the Elastic Cloud on Kubernetes (ECK) operator allows any low-privileged Kubernetes tenant to read secrets from arbitrary namespaces cluster-wide. The operator's reconciliation loop blindly trusts namespace references embedded in secret annotations without verifying whether the requesting user is authorized to access the referenced namespace, enabling a classic confused-deputy (CWE-441) privilege escalation that breaks Kubernetes RBAC namespace isolation. No public exploit code has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a material priority for any multi-tenant Kubernetes deployment running ECK; vendor-released patch version 3.5.0 is available per ESA-2026-121.
Cleartext token exposure in Elastic Cloud on Kubernetes allows any principal with namespace workload-spec read access to retrieve live Elasticsearch service account credentials. Affected deployments are those running Fleet Server resources configured to authenticate to Elasticsearch via service account tokens - ECK writes the token directly into the generated Pod specification in cleartext rather than referencing the Kubernetes Secret where other credentials are stored, bypassing an intentional RBAC boundary. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the confidentiality impact is high given that the exposed credential grants direct Elasticsearch data-plane access.
Incomplete credential cleanup in Elastic Cloud on Kubernetes (ECK Operator) allows a low-privileged tenant to retain unauthorized read access to an associated Elasticsearch cluster after a cross-namespace association attempt has been denied by Kubernetes RBAC enforcement. The root cause is CWE-459: when RBAC rejects the cross-namespace binding, ECK fails to revoke the authentication credentials it provisioned, leaving them valid and usable. With CVSS 3.5 and scope-changed vector (S:C), the vendor advisory ESA-2026-146 identifies the fix in ECK 3.5.0.
Cross-namespace certificate injection in Elastic Cloud on Kubernetes (ECK) Operator allows a low-privileged Kubernetes user confined to one namespace to insert attacker-controlled TLS certificate material into an Elasticsearch client trust bundle managed by ECK in a separate, distinct namespace. The flaw exploits incorrect authorization (CWE-863) via metadata spoofing (CAPEC-690), violating the namespace isolation boundary that Kubernetes clusters rely on for tenant separation. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the low privilege bar and network-accessible Kubernetes API make this a realistic threat in multi-tenant cluster environments.
Cross-namespace secret exfiltration in the Elastic Cloud on Kubernetes (ECK) operator allows any low-privileged Kubernetes tenant to read secrets from arbitrary namespaces cluster-wide. The operator's reconciliation loop blindly trusts namespace references embedded in secret annotations without verifying whether the requesting user is authorized to access the referenced namespace, enabling a classic confused-deputy (CWE-441) privilege escalation that breaks Kubernetes RBAC namespace isolation. No public exploit code has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a material priority for any multi-tenant Kubernetes deployment running ECK; vendor-released patch version 3.5.0 is available per ESA-2026-121.
Cleartext token exposure in Elastic Cloud on Kubernetes allows any principal with namespace workload-spec read access to retrieve live Elasticsearch service account credentials. Affected deployments are those running Fleet Server resources configured to authenticate to Elasticsearch via service account tokens - ECK writes the token directly into the generated Pod specification in cleartext rather than referencing the Kubernetes Secret where other credentials are stored, bypassing an intentional RBAC boundary. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the confidentiality impact is high given that the exposed credential grants direct Elasticsearch data-plane access.