Quick answers
- Is CVE-2026-72640 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-72640 being exploited in the wild.
- How severe is CVE-2026-72640?
- Medium severity, with a CVSS score of 6.5, published 13 August 2026.
- Which products and versions are affected?
- Elastic Cloud on Kubernetes up to and including 3.4.1.
- Is there a fix for CVE-2026-72640?
- A patch was published on 2026-08-13: Fixed in version 3.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-72640 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-72640?
- Check whether you run Elastic Cloud on Kubernetes or Elastic Cloud On Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a confused deputy vulnerability (CWE-441) in the ECK operator's annotation parsing logic. The operator reads secret references from an annotation on secrets it manages but fails to validate that the referenced namespace is authorized for the resource being reconciled. An attacker with Kubernetes API access limited to their own namespace can create a malicious annotation, trigger a reconciliation, and abuse the operator's cluster-wide secret permissions to read and copy arbitrary secrets from other namespaces. The vulnerability affects all versions up to 3.4.1; the fix is available in version 3.5.0. No workarounds are available for users unable to upgrade immediately.
Affected products
- Elastic Cloud on Kubernetes up to and including 3.4.1
Timeline
- 2026-08-13: disclosed
- 2026-08-13: patched: Fixed in version 3.5.0