Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN1113 _____________________________________________________________________ DATE : 30/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Elastic Cloud Enterprise (ECE) versions prior to 3.8.6, 4.2.1. ==================================================================== https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-211/391260 https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-212/391261 https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-215/391262 https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-216/391263 https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-218/391264 https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-221/391265 https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-4-2-1-security-update-esa-2026-222/391266 _____________________________________________________________________ Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-211) Announcements Security Announcements ismisepaul (Paul) October 29, 2026, 10:45am 1 Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages. Affected Versions: 1.x, 2.x and 3.x: All versions from 1.0.0 up to and including 3.8.5 4.x: All versions from 4.0.0 up to and including 4.2.0 Affected Configurations: All ECE installations on affected versions are affected. Exploitation requires administrative access to at least one host in the ECE installation, including a host that only runs the allocator role, or access to the internal ECE platform services from the network. ECE hosts and the internal ECE network are intended to be accessible only to trusted administrators. This deployment model limits exposure to this vulnerability. Solutions and Mitigations: The issue is resolved in version 3.8.6 and 4.2.1. The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Severity: CVSSv3.1: Medium ( 6.8 ) - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE ID: CVE-2026-115706 Problem Type: CWE-639 - Authorization Bypass Through User-Controlled Key Impact: CAPEC-122 - Privilege Abuse _____________________________________________________________________ Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-212) Announcements Security Announcements ismisepaul (Paul) October 29, 2026, 10:45am 1 Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lower-privileged platform components can read this data. An attacker who controls any host in the installation can use this data to get full control of the ECE control plane and of the deployments that it manages. Affected Versions: 2.x and 3.x: All versions from 2.6.0 up to and including 3.8.5 4.x: All versions from 4.0.0 up to and including 4.2.0 Affected Configurations: Only ECE installations on which the certificate rotation procedure was run are affected. Exploitation requires administrative access to at least one host in the ECE installation, or access to the internal ECE platform services from the network. ECE hosts and the internal ECE network are intended to be accessible only to trusted administrators. This deployment model limits exposure to this vulnerability. Solutions and Mitigations: The issue is resolved in version 3.8.6 and 4.2.1. The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading. If the certificate rotation procedure was run on your installation, run the cleanup command of the certificate rotation procedure from a host that has the director role after you upgrade. This removes the retained rotation data from the installation. ECE does not currently provide a procedure to rotate the ZooKeeper root password or the certificate authority keys. For Users that Cannot Upgrade: If the certificate rotation procedure was run on your installation, run its cleanup command from a host that has the director role. Do not run the certificate rotation procedure again until you upgrade to a fixed version. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Severity: CVSSv3.1: Medium ( 6.4 ) - CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE ID: CVE-2026-115707 Problem Type: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory Impact: CAPEC-37 - Retrieve Embedded Sensitive Data _____________________________________________________________________ Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-215) Announcements Security Announcements ismisepaul (Paul) October 29, 2026, 10:46am 1 Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132). Affected Versions: 1.x, 2.x and 3.x: All versions from 1.0.0 up to and including 3.8.5 4.x: All versions from 4.0.0 up to and including 4.2.0 Affected Configurations: ECE installations that run more than one deployment on the same allocator host. Exploitation requires that an attacker can run code inside an Elasticsearch deployment container, for example through custom bundles or plugins, or through another vulnerability. Solutions and Mitigations: The issue is resolved in version 3.8.6 and 4.2.1. The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Severity: CVSSv3.1: High ( 7.2 ) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N CVE ID: CVE-2026-115708 Problem Type: CWE-59 - Improper Link Resolution Before File Access ('Link Following') Impact: CAPEC-132 - Symlink Attack _____________________________________________________________________ Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-216) Announcements Security Announcements ismisepaul (Paul) October 29, 2026, 10:46am 1 Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132). Affected Versions: 2.x and 3.x: All versions from 2.6.0 up to and including 3.8.5 4.x: All versions from 4.0.0 up to and including 4.2.0 Affected Configurations: Exploitation requires that an attacker can run code inside an Elasticsearch deployment container, for example through custom bundles or plugins, or through another vulnerability. Solutions and Mitigations: The issue is resolved in version 3.8.6 and 4.2.1. The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Severity: CVSSv3.1: High ( 8.2 ) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE ID: CVE-2026-115709 Problem Type: CWE-59 - Improper Link Resolution Before File Access ('Link Following') Impact: CAPEC-132 - Symlink Attack _____________________________________________________________________ Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-218) Announcements Security Announcements ismisepaul (Paul) October 29, 2026, 10:46am 1 Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). ECE stores runtime information about platform service containers in a location that lower-privileged platform components can read, and this information includes secrets from the container configuration. An attacker with access to the internal ECE platform services can obtain these secrets, which include role tokens. A role token can let the attacker add an unauthorized host to the installation with the roles of that token. Affected Versions: 1.x, 2.x and 3.x: All versions from 1.0.0 up to and including 3.8.5 4.x: All versions from 4.0.0 up to and including 4.2.0 Affected Configurations: All ECE installations on affected versions are affected. The risk is higher if hosts were added with persistent role tokens. Exploitation requires access to the internal ECE platform services from the network, or administrative access to a host in the installation. ECE hosts and the internal ECE network are intended to be accessible only to trusted administrators. This deployment model limits exposure to this vulnerability. Solutions and Mitigations: The issue is resolved in version 3.8.6 and 4.2.1. The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading. After you upgrade all hosts, revoke the persistent role tokens that you no longer need. To add hosts in the future, use new role tokens, and prefer ephemeral role tokens. For Users that Cannot Upgrade: Revoke the persistent role tokens that you no longer need. To add hosts, use ephemeral role tokens. Indicators of Compromise (IOC) Hosts in the ECE platform host list that your organization did not add can indicate exploitation of this vulnerability. Severity: CVSSv3.1: Medium ( 6.4 ) - CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE ID: CVE-2026-115711 Problem Type: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory Impact: CAPEC-37 - Retrieve Embedded Sensitive Data _____________________________________________________________________ Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-221) Announcements Security Announcements ismisepaul (Paul) October 29, 2026, 10:47am 1 Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change. Affected Versions: 3.x: All versions from 3.8.0 up to and including 3.8.5 4.x: All versions from 4.0.0 up to and including 4.2.0 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in version 3.8.6 and 4.2.1. The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Severity: CVSSv3.1: Medium ( 4.3 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVE ID: CVE-2026-115712 Problem Type: CWE-863 - Incorrect Authorization Impact: CAPEC-1 - Accessing Functionality Not Properly Constrained by ACLs _____________________________________________________________________ Elastic Cloud Enterprise (ECE) 4.2.1 Security Update (ESA-2026-222) Announcements Security Announcements ismisepaul (Paul) October 29, 2026, 10:47am 1 Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132). Affected Versions: 4.x: All versions from 4.1.0 up to and including 4.2.0 Users on the 3.x release line, including 3.8.x, and on 4.0.x are not affected. The functionality that contains this vulnerability was introduced in 4.1.0 and is not present in earlier releases. Affected Configurations: ECE deployments that include an Enterprise Search instance. Exploitation requires that an attacker can already run code inside the Enterprise Search instance container. Deployments without an Enterprise Search instance are not exposed. Solutions and Mitigations: The issue is resolved in version 4.2.1. The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for thi vulnerability. Severity: CVSSv3.1: High ( 7.5 ) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE ID: CVE-2026-115713 Problem Type: CWE-59 - Improper Link Resolution Before File Access ('Link Following') Impact: CAPEC-132 - Symlink Attack ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================