Is CVE-2026-78600 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-78600?

CVE-2026-78600 has a CVSS v3 severity of LOW (3.5).

Back

CVE-2026-78600

Description

Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.