Cleartext Storage Vulnerability in Elastic Cloud on Kubernetes

CVE-2026-72648

What is CVE-2026-72648?

The Elastic Cloud on Kubernetes (ECK) vulnerability arises from the cleartext storage of sensitive information, specifically a service account token, in workload specifications. When ECK processes a Fleet Server resource and stores the token directly in cleartext instead of referencing it from a secure Kubernetes Secret, it exposes the risk of unauthorized access. Any user with the ability to read the workload specifications in the affected namespace can potentially access live Elasticsearch credentials, regardless of whether they have permission to access the Secrets via Kubernetes RBAC. This can lead to information disclosure and significant security concerns within cloud-native environments.

References