Executive brief
Elastic Cloud on Kubernetes (ECK) is a platform that automates deployment and management of Elasticsearch clusters on Kubernetes. A flaw in the software fails to properly remove authentication credentials when cross-namespace access is revoked, allowing a low-privileged user to retain unauthorized read access to Elasticsearch clusters even after their permissions are supposed to be removed. This could lead to sensitive data exposure if an attacker has any access to the Kubernetes cluster.
Technical details
This vulnerability is an incomplete cleanup issue (CWE-459) where authentication credentials persist after RBAC-enforced denial of cross-namespace associations. When cross-namespace resource associations are established and subsequently revoked through RBAC policy changes, the underlying credentials are not properly cleaned up, allowing a low-privileged tenant to retain read access to Elasticsearch clusters they should no longer be able to access. The vulnerability affects deployments using cross-namespace associations where RBAC enforcement is either newly enabled or previously granted permissions are revoked. Attack vector is network-based, requires low privilege (authenticated tenant access), and no user interaction. The issue is patched in version 3.5.0; no workarounds are available for earlier versions.
Affected products
- Elastic Cloud on Kubernetes 2.6.0 to 3.4.1
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Fixed in version 3.5.0