PatchTheCVECVE-2026-72640: The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets
CVE-2026-72640 is a medium-severity flaw (CVSS 6.5) affecting elastic cloud on kubernetes. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is authorized for the resource being reconciled. A user whose Kubernetes permissions are limited to their own namespace can write that annotation, trigger a reconcile, and cause the operator to use its cluster-wide secret permissions
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 69%) |
| CISA exploited list | No |
| Weakness | CWE-441 |
| Published | 2026-08-13 |
| Last modified | 2026-09-03 |
Last updated 2026-09-03 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-72640?
elastic cloud on kubernetes: upgrade to 3.5.0. Exact commands for each OS are on this page.
Is CVE-2026-72640 being exploited?
CVE-2026-72640 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-72640 affect?
CVE-2026-72640 affects elastic cloud on kubernetes. Severity is medium (CVSS 6.5). The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is authorized for the r
How urgent is CVE-2026-72640?
Priority 36/100. On your watchlist
Software pages
Related CVEs
- CVE-2026-72648 MEDIUM 6.5 UPGRADE Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes
- CVE-2026-78609 MEDIUM 5.4 UPGRADE Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification o
- CVE-2026-78600 LOW 3.5 UPGRADE Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privileg