CVE-2026-78600 Overview
CVE-2026-78600 is an incomplete cleanup vulnerability [CWE-459] in Elastic Cloud on Kubernetes (ECK). The flaw allows a low-privileged tenant to retain unauthorized read access to an associated Elasticsearch cluster after a cross-namespace association has been denied by Role-Based Access Control (RBAC) enforcement. Authentication credentials persist beyond the point at which authorization is revoked, breaking the tenant isolation model in multi-tenant Kubernetes deployments.
Critical Impact
A low-privileged tenant can maintain read access to Elasticsearch data in another namespace after RBAC denies the association, resulting in confidentiality loss across tenant boundaries.
Affected Products
- Elastic Cloud on Kubernetes (ECK) operator
- Elasticsearch clusters managed through ECK cross-namespace associations
- Multi-tenant Kubernetes environments running ECK prior to version 3.5.0
Discovery Timeline
- 2026-09-02 - CVE-2026-78600 published to the National Vulnerability Database
- 2026-09-02 - Last updated in NVD database
- Advisory - Elastic published security update ESA-2026-146 covering ECK 3.5.0
Technical Details for CVE-2026-78600
Vulnerability Analysis
ECK manages Elasticsearch clusters through custom resources and enforces cross-namespace associations using Kubernetes RBAC. When a tenant in one namespace associates a resource (such as a Kibana or APM Server instance) with an Elasticsearch cluster in another namespace, ECK provisions credentials that authenticate the tenant to the target cluster.
The vulnerability arises when RBAC subsequently denies that association. The operator revokes the authorization decision but does not fully clean up the previously issued authentication credentials. Those credentials remain valid and continue to grant read access to the Elasticsearch cluster.
The issue is scoped to confidentiality. It does not permit modification of data, code execution, or denial of service against the target cluster.
Root Cause
The root cause is incomplete cleanup [CWE-459] of authentication material during the association-denial code path. Credential lifecycle in the ECK operator is not fully coupled to the RBAC decision that governs cross-namespace association, so revocation of authorization does not invalidate the credential.
Attack Vector
Exploitation requires an attacker who already holds low-privileged credentials in a Kubernetes namespace managed by ECK. The attacker first establishes a cross-namespace association with an Elasticsearch cluster. When an administrator later denies the association through RBAC, the attacker retains and reuses the residual credentials to read data from the target cluster. The attack path requires network access to the Elasticsearch endpoint and is categorized as Privilege Abuse (CAPEC-122).
No verified public exploit code is available for CVE-2026-78600. Refer to the Elastic Security Update ESA-2026-146 for vendor technical details.
Detection Methods for CVE-2026-78600
Indicators of Compromise
- Successful Elasticsearch authentication events originating from service accounts or tenants whose cross-namespace association has been denied or removed.
- Continued API access to an Elasticsearch cluster from a namespace after the corresponding ECK association resource was rejected by RBAC.
- Elasticsearch audit log entries showing read queries executed by credentials tied to a revoked association.
Detection Strategies
- Correlate Kubernetes RBAC denial events on ECK association resources with subsequent successful authentications against the referenced Elasticsearch cluster.
- Inventory active Elasticsearch users and API keys, then reconcile them against the current set of approved ECK associations. Flag any credential without a matching approved association.
- Enable Elasticsearch audit logging and alert on read operations executed by credentials that map to denied or deleted association objects.
Monitoring Recommendations
- Ship ECK operator logs, Kubernetes audit logs, and Elasticsearch audit logs to a centralized analytics platform for cross-source correlation.
- Track the lifecycle of every association secret and API key issued by the ECK operator, and alert when a credential outlives its parent association.
- Review namespace-level tenancy boundaries on a recurring cadence to confirm that denied associations produce no residual authenticated sessions.
How to Mitigate CVE-2026-78600
Immediate Actions Required
- Upgrade the ECK operator to version 3.5.0 or later, which addresses the incomplete cleanup issue per ESA-2026-146.
- Rotate all Elasticsearch credentials and API keys that were issued through cross-namespace associations prior to the upgrade.
- Audit existing cross-namespace associations and remove any that are no longer authorized, then verify no residual credentials remain.
Patch Information
Elastic released the fix in Elastic Cloud on Kubernetes 3.5.0. Full vendor guidance is documented in the Elastic Security Update ESA-2026-146.
Workarounds
- Avoid granting cross-namespace association permissions to low-privileged tenants until the ECK operator is upgraded.
- Manually revoke and rotate Elasticsearch credentials whenever an association is denied or deleted, rather than relying on operator cleanup.
- Segment multi-tenant workloads so that Elasticsearch clusters holding sensitive data reside in namespaces that do not accept associations from untrusted tenants.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
