CLEANSTART-2026-DG03733 Security fixes in eck-operator-fips 3.4.1-r2

Package eck-operator-fips version 3.4.1-r2 fixes 1 vulnerabilities: CVE-2026-56852...

CLEANSTART-2026-XO42004 Security fixes in eck-operator 3.4.1-r3

Package eck-operator version 3.4.1-r3 fixes 1 vulnerabilities: CVE-2026-56852...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-121)

Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure The Elastic Cloud on Kubernetes ECK operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-113)

Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure Cleartext Storage of Sensitive Information in an Environment Variable CWE-526 in Elastic Cloud on Kubernetes ECK can lead to information disclosure via Retrieve...

PT-2026-85951

Package eck-operator version 3.4.1-r1 fixes 2 vulnerabilities: ghsa-hrxh-6v49-42gf, ghsa-gcjh-h69q-9w9g...

PT-2026-85971

Package eck-operator-fips version 3.4.1-r1 fixes 2 vulnerabilities: ghsa-hrxh-6v49-42gf, ghsa-gcjh-h69q-9w9g...

CVE-2026-72640: Unintended Proxy or Intermediary

The Elastic Cloud on Kubernetes ECK operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is authorized for the resource being reconciled. A user whose Kubernetes permissio...

PT-2026-71758

The Elastic Cloud on Kubernetes ECK operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is authorized for the resource being reconciled. A user whose Kubernetes permissio...

PT-2026-71763

Cleartext Storage of Sensitive Information in an Environment Variable CWE-526 in Elastic Cloud on Kubernetes ECK can lead to information disclosure via Retrieve Embedded Sensitive Data CAPEC-37. When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account...

CVE-2026-72648: Cleartext Storage of Sensitive Information in an Environment Variable

Cleartext Storage of Sensitive Information in an Environment Variable CWE-526 in Elastic Cloud on Kubernetes ECK can lead to information disclosure via Retrieve Embedded Sensitive Data CAPEC-37. When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account...

CLEANSTART-2026-PH99378 Security fixes in eck-operator 3.2.0-r0

Package eck-operator version 3.2.0-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

CLEANSTART-2026-OX83078 Security fixes in eck-operator-fips 3.2.0-r0

Package eck-operator-fips version 3.2.0-r0 fixes 12 vulnerabilities: CVE-2025-58187, CVE-2025-58188, CVE-2025-61723, CVE-2025-61725, CVE-2025-47912...

PT-2026-85988

Package eck-operator version 3.2.0-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

CLEANSTART-2026-HN09351 Security fixes for CVE-2025-61727, CVE-2025-61729, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x applied in versions: 3.2.0-r0, 3.2.0-r1

Multiple security vulnerabilities affect the eck-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63695

Multiple security vulnerabilities affect the eck-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JJ06077 Security fixes for CVE-2025-61727, CVE-2025-61729, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x applied in versions: 3.2.0-r0, 3.2.0-r1

Multiple security vulnerabilities affect the eck-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WW60786 Security fixes for CVE-2025-61727, CVE-2025-61729, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x applied in versions: 3.2.0-r0, 3.2.0-r1

Multiple security vulnerabilities affect the eck-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GU65783 Within HostnameError

Multiple security vulnerabilities affect the eck-operator package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-LO88261 Within HostnameError

Multiple security vulnerabilities affect the eck-operator package. Within HostnameError. See references for individual vulnerability details...

CVE-2023-31416

Secret token configuration is never applied when using ECK =8.0. This could lead to anonymous requests to an APM Server being accepted and the data ingested into this APM deployment...