Quick answers
- Is CVE-2026-78600 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78600 being exploited in the wild.
- How severe is CVE-2026-78600?
- Low severity, with a CVSS score of 3.5, published 2 September 2026.
- Which products and versions are affected?
- Elastic Cloud on Kubernetes 2.6.0 to 3.4.1.
- Is there a fix for CVE-2026-78600?
- A patch was published on 2026-09-02: Fixed in version 3.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78600 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-78600?
- Check whether you run Elastic Cloud on Kubernetes or Elastic Cloud On Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is an incomplete cleanup issue (CWE-459) where authentication credentials persist after RBAC-enforced denial of cross-namespace associations. When cross-namespace resource associations are established and subsequently revoked through RBAC policy changes, the underlying credentials are not properly cleaned up, allowing a low-privileged tenant to retain read access to Elasticsearch clusters they should no longer be able to access. The vulnerability affects deployments using cross-namespace associations where RBAC enforcement is either newly enabled or previously granted permissions are revoked. Attack vector is network-based, requires low privilege (authenticated tenant access), and no user interaction. The issue is patched in version 3.5.0; no workarounds are available for earlier versions.
Affected products
- Elastic Cloud on Kubernetes 2.6.0 to 3.4.1
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Fixed in version 3.5.0