Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-212)

Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lower-privileged platform components can read this data. An attacker who controls any host in the ins…

在 Elastic Security Announcements 阅读

2026/10/29 19:45，Elastic Security Announcements 发布了“Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-212)”（类型：漏洞公告）。相关技术：Elasticsearch / OpenSearch。