The Elastic Cloud on Kubernetes (ECK) operator reads secret references from annotations on secrets it manages and accepts the namespace recorded in each reference without validating if the reference is authorized for the resource being reconciled. A user with Kubernetes permissions limited to their own namespace can write this annotation and trigger a reconcile, causing the operator to use its cluster-wide secret permissions to copy the contents of a secret from any other namespace into a secret readable by the user. This is a CWE-441 (Confused Deputy) vulnerability affecting version 3.0.0 of the ECK operator.

An attacker with limited permissions confined to their own namespace can exploit this vulnerability to access secrets from other namespaces by leveraging the operator's cluster-wide secret permissions. This results in unauthorized disclosure of sensitive information stored in Kubernetes secrets across namespaces.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user permissions to minimize the risk of unauthorized annotation modifications and monitor for unusual reconcile triggers involving secrets.