Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-115711

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in…

Risk score
41/100
CVSS
6.4 v3.1
Exploit chance (30 days)
0.2%
Published
29 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). ECE stores runtime information about platform service containers in a location that lower-privileged platform co…
Affected
Elastic Cloud Enterprise
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Elastic Cloud EnterpriseTHE FLAWSTHE FIXCVE-2026-115711Insertion of SensitiveInformation intoExternally-Accessible File or…CVSS 6.4 · EPSS 0%CVE-2026-115709Improper Link ResolutionBefore File Access ('LinkFollowing') (CWE-59) in…CVSS 8.2 · EPSS 0%CVE-2026-115713Improper Link ResolutionBefore File Access ('LinkFollowing') (CWE-59) in…CVSS 7.5 · EPSS 0%CVE-2026-115708Authentication bypassCVSS 7.2 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedElastic Cloud EnterpriseYELLOW · PLAN IT INElastic CloudEnterpriseImproper Link Resolution BeforeFile Access ('Link Following')(CWE-59) in Elastic CloudEnterprise (ECE) can lead tounauthorized disclosure and lossof data belonging to otherdeployments on the same host…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-538 (CWE-538)3 other warnings in 30 days →Same productEarlier Elastic Cloud Enterprise warnings3 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Elastic Cloud Enterprise: Yellow, plan it in. Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).

The flaws

  • CVE-2026-115711: Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in… (CVSS 6.4 · EPSS 0%)
  • CVE-2026-115709: Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise… (CVSS 8.2 · EPSS 0%)
  • CVE-2026-115713: Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise… (CVSS 7.5 · EPSS 0%)
  • CVE-2026-115708: Authentication bypass (CVSS 7.2 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Elastic Cloud Enterprise

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.4 medium

References

Original description

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). ECE stores runtime information about platform service containers in a location that lower-privileged platform components can read, and this information includes secrets from the container configuration. An attacker with access to the internal ECE platform services can obtain these secrets, which include role tokens. A role token can let the attacker add an unauthorized host to the installation with the roles of that token.

Last activity 29 Oct 2026. Patch Forecast updates every hour.