CVE-2026-115707
Description
A flaw was found in Elastic Cloud Enterprise (ECE). Following a certificate rotation procedure, retained data exposes platform credentials and certificate authority private keys to lower-privileged platform components. An attacker with access to any host in the installation can read this data to escalate privileges and gain full administrative control over the ECE control plane and managed deployments.
Statement
This vulnerability is rated as Moderate severity for Red Hat because successful exploitation requires high privileges, including existing access to a host within the cluster, as well as specific execution of a certificate rotation procedure. Elastic Cloud Enterprise is third-party software that is neither packaged nor distributed with Red Hat products. Consequently, Red Hat supported environments and core offerings do not expose or deploy this component.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
