CVE-2023-31416

The CVE-2023-31416 issue affects Elastic Cloud on Kubernetes (ECK) before 2.8 when used with APM Server 8.0 or later. The root cause is that the secret token configuration is not applied, which could allow anonymous requests to be accepted and lead to data ingestion into the APM deployment. Affec...

CVE-2020-7010

CVE-2020-7010 affects Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0. The issue is a weak random number generator used to generate Elasticsearch credentials, which can enable easier brute-forcing if an attacker can determine when the cluster was deployed. Affected text from connected s...

CVE-2026-72640

Summary: The Elastic Cloud on Kubernetes (ECK) operator has a vulnerability where it reads secret references from an annotation on secrets it manages and trusts the listed namespace without validating authorization. This allows a user with permissions limited to their own namespace to trigger a r...

CVE-2026-72648

Elastic Cloud on Kubernetes (ECK) has a vulnerability CVE-2026-72648 where a Fleet Server authentication token is written in cleartext into the generated workload specification instead of being mounted from the Kubernetes Secret. This allows principals with access to workload specs in the affecte...

CVE-2026-78609

Elastic Cloud on Kubernetes (ECK) versions 2.6.0 through 3.4.1 are affected by an Incorrect Authorization flaw (CWE-863) that enables Metadata Spoofing (CAPEC-690). An actor with limited Kubernetes permissions in one namespace can inject attacker-controlled certificate material into the Elasticse...

CVE-2026-78600

Elastic Cloud on Kubernetes (ECK) is affected by an Incomplete Cleanup (CWE-459) flaw where authentication credentials persist after a cross-namespace association is denied by RBAC enforcement. This allows a low-privileged tenant to retain unauthorized read access to an associated Elasticsearch c...