CVE-2026-78609: CWE-863 Incorrect Authorization in Elastic Eck Operator

This vulnerability (CWE-863) in Elastic ECK Operator allows a Kubernetes user with limited permissions in one namespace to influence the trust bundle of Elasticsearch clients in another namespace by injecting attacker-controlled certificate material. This is due to incorrect authorization checks in the operator's handling of metadata, enabling metadata spoofing (CAPEC-690). The flaw could lead to unauthorized data modification by leveraging the trust bundle manipulation. The issue is confirmed in version 2.6.0 of the ECK Operator. No official patch or remediation level has been published yet.

An attacker with limited Kubernetes permissions restricted to a single namespace can cause unauthorized modification of data by injecting malicious certificate material into the Elasticsearch client trust bundle in a separate namespace. This could undermine the integrity of communications and trust relationships managed by the ECK Operator, potentially allowing unauthorized access or data manipulation within Elasticsearch clusters.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Kubernetes permissions carefully to minimize cross-namespace influence and monitor for unusual certificate changes in Elasticsearch client trust bundles.