# CVE-2026-72648: Elastic Cloud on Kubernetes cleartext storage of service account tokens

Source: https://junglewise.ai/threats/cve-2026-72648-elastic-cloud-on-kubernetes-cleartext-storage-of-service-account  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72648 · Severity: medium · CVSS 6.5 · Published 2026-08-13

Elastic Cloud on Kubernetes (ECK) inadvertently stores Elasticsearch service account authentication tokens in cleartext within workload specifications, rather than securely referencing them from Kubernetes Secrets. This allows any user with permission to read workload specifications in a Kubernetes namespace to access live Elasticsearch credentials, even if they lack authorization to read Secrets directly. This could enable unauthorized access to Elasticsearch databases and sensitive data they contain.

Technologies: [Elastic Cloud on Kubernetes](https://junglewise.ai/threats/technologies/cloud-on-kubernetes). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-72648 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72648 being exploited in the wild.

**How severe is CVE-2026-72648?** Medium severity, with a CVSS score of 6.5, published 13 August 2026.

**Which products and versions are affected?** Elastic Cloud on Kubernetes 3.0.0 through 3.4.1.

**Is there a fix for CVE-2026-72648?** A patch was published on 2026-08-13: Fixed in version 3.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-72648 attacked?** It is attacked over the network or from the adjacent network, in a hosted service.

**Am I affected by CVE-2026-72648?** Check whether you run Elastic Cloud on Kubernetes or Elastic Cloud On Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cleartext storage issue (CWE-526) in ECK's reconciliation logic for Fleet Server resources. When ECK processes a Fleet Server resource configured to authenticate to Elasticsearch using a service account token, it embeds the token directly in the generated workload specification (Pod, Deployment, or similar) rather than referencing the Kubernetes Secret that holds other credentials. An attacker with workload read access (via Kubernetes RBAC permissions) can extract the token from workload manifests and authenticate directly to Elasticsearch. The attack requires legitimate Kubernetes namespace access but bypasses Secret-level access controls. The vulnerability affects all 3.x versions from 3.0.0 through 3.4.1, and is resolved in version 3.5.0. Elastic recommends invalidating and rotating affected service account tokens after upgrading.

## Affected products

- Elastic Cloud on Kubernetes 3.0.0 through 3.4.1

## Timeline

- 2026-08-13: disclosed
- 2026-08-13: patched: Fixed in version 3.5.0

## References

- [https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-113/389493](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-113/389493)

## Related threats

- [Elastic Cloud on Kubernetes incorrect authorization in multi-tenant environments](https://junglewise.ai/threats/cve-2026-78609-elastic-cloud-on-kubernetes-incorrect-authorization-in-multi)
- [Elastic Cloud on Kubernetes incomplete cleanup leading to unauthorized access](https://junglewise.ai/threats/cve-2026-78600-elastic-cloud-on-kubernetes-incomplete-cleanup-leading-to)
- [Elastic Cloud on Kubernetes cross-namespace secret disclosure](https://junglewise.ai/threats/cve-2026-72640-elastic-cloud-on-kubernetes-cross-namespace-secret-disclosure)