Description

Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-02T15:17:41.137Z",
  "pubdate": "2026-09-02T15:17:41.137Z",
  "executiveSummary": "This vulnerability involves an Incomplete Cleanup (CWE-459) issue within Elastic Cloud on Kubernetes (ECK) that facilitates Privilege Abuse (CAPEC-122).\nThe flaw occurs when cross-namespace resource associations are rejected by Kubernetes Role-Based Access Control (RBAC) enforcement mechanisms.\nDespite the denial of access, ECK fails to purge authentication credentials associated with the rejected cluster connection.\nThis persistence of credentials enables a low-privileged tenant to retain unauthorized read access to an Elasticsearch cluster that should be restricted.\nThe risk implication is significant, as it violates the principle of least privilege and allows for persistent unauthorized data access across namespace boundaries.\nThe vulnerability requires an attacker to possess existing low-privileged access within a namespace to attempt the cross-namespace association.\nThe primary impact is the unauthorized disclosure of information stored within the Elasticsearch cluster, potentially compromising sensitive indices and configuration data.",
  "technicalDetails": "The vulnerability stems from an Incomplete Cleanup (CWE-459) process during the reconciliation loop of Elastic Cloud on Kubernetes (ECK).\nWhen a user or process attempts to link an Elasticsearch cluster across namespace boundaries, the Kubernetes RBAC subsystem correctly identifies the lack of authorization and denies the association.\nHowever, the ECK operator fails to perform a comprehensive garbage collection or session invalidation for the credentials provisioned during the initial request attempt.\nThe internal state machine of the ECK controller erroneously caches or retains the authentication tokens, API keys, or certificates intended for the requested cluster connection, despite the RBAC failure.\nConsequently, the low-privileged tenant retains these credentials in the local namespace context, even though the cross-namespace link was formally denied by the cluster control plane.\nExploitation flow: 1. A low-privileged tenant initiates a cross-namespace Elasticsearch connection request via ECK Custom Resource (CR) definitions. 2. Kubernetes RBAC denies the cross-namespace access request as expected. 3. The ECK operator aborts the provisioning process but does not clear the staged authentication context. 4. The low-privileged actor intercepts or extracts the persistent credentials from the local namespace environment. 5. Using the retained credentials, the actor performs unauthorized read operations against the target Elasticsearch cluster, bypassing the intended RBAC isolation.\nThe vulnerable component is the ECK reconciliation logic responsible for credential lifecycle management and cleanup during failed resource transitions.\nThis persistence allows for post-exploitation unauthorized data access, potentially spanning the entire lifecycle of the orphaned credentials until a manual cleanup or cluster restart occurs.\nThe lack of atomicity between the RBAC verification check and the credential provisioning/teardown sequence represents a fundamental design flaw in the operator's handling of cross-namespace dependencies."
}