---
id: CVE-2026-115706
title: >-
  Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise
  (ECE) Leading to Privilege Escalation
summary: >-
  Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud
  Enterprise (ECE) can lead to privilege escalation via Privilege Abuse
  (CAPEC-122). An attacker who controls any host in an ECE installation can
  obtain credential…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-639
vendor: Elastic
product: Elastic Cloud Enterprise
affected:
  - cloud_enterprise >= 1.0.0 <= 3.8.5
  - cloud_enterprise >= 4.0.0 <= 4.2.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T03:56:15.368437Z'
published: '2026-10-29'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:18:29.029Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115706'
references:
  - url: >-
      https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-211/391260
tags:
  - cve.org
epss: 0.00245
epssPercentile: 0.15799
ingestedAt: '2026-11-05T16:24:31.187Z'
---

## Overview

Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.

## Affected

- `cloud_enterprise >= 1.0.0 <= 3.8.5`
- `cloud_enterprise >= 4.0.0 <= 4.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.