Sensitive Information Exposure in Elastic Cloud Enterprise

CVE-2026-115707

What is CVE-2026-115707?

A vulnerability exists in Elastic Cloud Enterprise where sensitive information can be inadvertently exposed into externally-accessible files or directories. This exposure occurs during the certificate rotation process, where essential data such as platform credentials and certificate authority private keys are improperly retained. Consequently, lower-privileged components within the platform can access this sensitive data. If an attacker compromises any host within the Elastic Cloud Enterprise installation, they could exploit this vulnerability to gain full control over the ECE control plane and the managed deployments, significantly jeopardizing security.

References