CVE-2026-72640 in Eck Operator
Summary
by MITRE • 08/13/2026
The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is authorized for the resource being reconciled. A user whose Kubernetes permissions are limited to their own namespace can write that annotation, trigger a reconcile, and cause the operator to use its cluster-wide secret permissions to copy the contents of a secret from any other namespace into a secret the user can read.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability in Elastic Cloud on Kubernetes ECK operator represents a critical privilege escalation issue stemming from inadequate authorization validation during secret management operations. This flaw allows attackers with limited namespace-level permissions to exploit the operator's trust model and gain access to sensitive information across cluster boundaries. The vulnerability specifically manifests when the ECK operator processes secret references stored in annotations on managed secrets, failing to validate whether the referencing user has proper authorization to access the target secret resource.
The technical implementation of this vulnerability lies in the operator's lack of namespace validation for secret references within annotations. When a user with restricted permissions modifies an annotation containing a secret reference, the operator blindly accepts the namespace specified in that reference and proceeds to copy the secret contents using its elevated cluster-wide privileges. This design flaw creates a path where a user can manipulate the reconciliation process by injecting malicious secret references into annotations, thereby bypassing standard Kubernetes RBAC controls that should prevent cross-namespace access.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables attackers to escalate privileges and potentially access sensitive data from other namespaces. This includes credentials, API keys, configuration secrets, and other confidential information stored in cluster secrets. The vulnerability is particularly dangerous because it leverages the operator's legitimate cluster-wide permissions to perform unauthorized actions, making detection more challenging and potentially allowing persistent access patterns that could evade traditional monitoring systems.
This vulnerability aligns with CWE-284 (Improper Access Control) and represents a classic case of privilege escalation through insecure object references. The attack vector follows ATT&CK technique T1078.004 (Valid Accounts: Cloud Accounts) by exploiting legitimate operator permissions to access unauthorized resources, while also demonstrating characteristics of T1566 (Phishing for Information) through the manipulation of annotations as a means to achieve unauthorized access. Organizations using ECK should consider implementing additional controls such as namespace isolation policies, secret reference validation mechanisms, and enhanced monitoring of annotation modifications to prevent exploitation of this vulnerability.
The remediation approach requires implementing strict namespace validation for all secret references processed by the operator, ensuring that references are only accepted when they align with the user's authorized permissions. This includes validating that the referencing user has appropriate access rights to both the source and target namespaces of any secret references. Additionally, operators should implement proper audit logging and monitoring to detect suspicious annotation modifications and unauthorized secret access patterns, while also considering implementing least-privilege principles for operator permissions to minimize potential impact if such vulnerabilities are exploited in the future.