# CVE-2026-115707: Elastic Cloud Enterprise certificate rotation sensitive data exposure

Source: https://junglewise.ai/threats/cve-2026-115707-insertion-of-sensitive-information-into-externally-accessible  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-115707 · Severity: medium · CVSS 6.4 · Published 2026-10-29

Elastic Cloud Enterprise (ECE), a platform for managing Elasticsearch deployments, retains sensitive data including platform credentials and certificate authority private keys after certificate rotation procedures complete. An attacker with administrative access to any host in an ECE installation can read this retained data and gain full control of the control plane and all managed deployments.

Technologies: [Elastic Cloud Enterprise](https://junglewise.ai/threats/technologies/elastic-cloud-enterprise). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-115707 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115707 being exploited in the wild.

**How severe is CVE-2026-115707?** Medium severity, with a CVSS score of 6.4, published 29 October 2026.

**Which products and versions are affected?** Elastic Cloud Enterprise 2.6.0 to 3.8.5, 4.0.0 to 4.2.0.

**Is there a fix for CVE-2026-115707?** Yes: fixed in 3.8.6 and 4.2.1. Until then: If certificate rotation has been run, execute the cleanup command of the certificate rotation procedure from a host with the director role to remove retained rotation data. Do not run the certificate rotation procedure again until upgrading to a fixed version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115707 attacked?** It is attacked from the adjacent network or with local access, in a hosted service.

**Am I affected by CVE-2026-115707?** Check whether you run Elastic Cloud Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.8.6 and 4.2.1

If certificate rotation has been run, execute the cleanup command of the certificate rotation procedure from a host with the director role to remove retained rotation data. Do not run the certificate rotation procedure again until upgrading to a fixed version.

## Technical details

The vulnerability (CWE-538) involves the ECE certificate rotation procedure leaving sensitive data containing platform credentials and CA private keys in externally-accessible locations where lower-privileged platform components can read it. Exploitation requires administrative access to at least one host in the installation or access to internal ECE platform services from the network. An attacker gains full control of the ECE control plane and managed deployments.

## Affected products

- Elastic Cloud Enterprise 2.6.0 to 3.8.5, 4.0.0 to 4.2.0

## Timeline

- 2026-10-29: disclosed

## References

- [https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-212/391261](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-212/391261)

## Related threats

- [Elastic Cloud Enterprise symlink attack leads to data access](https://junglewise.ai/threats/cve-2026-115713-improper-link-resolution-before-file-access-link-following-cwe)
- [Elastic Cloud Enterprise authorization bypass in platform settings](https://junglewise.ai/threats/cve-2026-115712-incorrect-authorization-cwe-863-in-elastic-cloud-enterprise-ece)
- [Elastic Cloud Enterprise credential exposure in container runtime data](https://junglewise.ai/threats/cve-2026-115711-insertion-of-sensitive-information-into-externally-accessible)
- [Elastic Cloud Enterprise symlink attack via improper link resolution](https://junglewise.ai/threats/cve-2026-115709-improper-link-resolution-before-file-access-link-following-cwe)
- [Elastic Cloud Enterprise symlink attack authentication bypass](https://junglewise.ai/threats/cve-2026-115708-improper-link-resolution-before-file-access-link-following-cwe)