Executive brief
The Elastic Cloud on Kubernetes (ECK) operator manages containerized deployments of Elastic Stack components in Kubernetes clusters. A namespace-isolated user can manipulate secret references to trick the operator into copying secrets from any other namespace in the cluster, allowing unauthorized data theft. The operator's cluster-wide permissions are abused to bypass intended namespace boundaries, exposing sensitive configuration and credentials.
Technical details
This is a confused deputy vulnerability (CWE-441) in the ECK operator's annotation parsing logic. The operator reads secret references from an annotation on secrets it manages but fails to validate that the referenced namespace is authorized for the resource being reconciled. An attacker with Kubernetes API access limited to their own namespace can create a malicious annotation, trigger a reconciliation, and abuse the operator's cluster-wide secret permissions to read and copy arbitrary secrets from other namespaces. The vulnerability affects all versions up to 3.4.1; the fix is available in version 3.5.0. No workarounds are available for users unable to upgrade immediately.
Affected products
- Elastic Cloud on Kubernetes up to and including 3.4.1
Timeline
- 2026-08-13: disclosed
- 2026-08-13: patched: Fixed in version 3.5.0