// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Yesterday
-
Elastic Cloud Enterprise (ECE) 4.2.1 Security Update (ESA-2026-222)
Elastic Cloud Enterprise (ECE) 4.2.1 has a Link Following flaw (CWE-59) allowing unauthorized read and write access to other deployments on the same host via Symlink Attack.
-
Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-221)
Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 update addresses Incorrect Authorization (CWE-863) allowing authenticated read-only users to modify platform settings.
-
Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-218)
Elastic Cloud Enterprise (ECE) versions 3.8.6 and 4.2.1 received a security update addressing CWE-538, which could allow credential disclosure via externally-accessible files.
-
Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-216)
Elastic Cloud Enterprise (ECE) versions 3.8.6 and 4.2.1 received an update addressing Improper Link Resolution Before File Access (CWE-59) allowing unauthorized data disclosure and loss via Symlink Attack.
-
Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-215)
Elastic Cloud Enterprise (ECE) versions up to 3.8.5 and 4.0 have an Improper Link Resolution flaw allowing authentication bypass and unauthorized configuration changes via Symlink Attack.
-
Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-212)
Elastic Cloud Enterprise (ECE) versions 3.8.6 and 4.2.1 received a security update addressing CWE-538, which allows privilege escalation via retrieving embedded sensitive data.
-
Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-211)
Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 update addresses an authorization bypass flaw allowing an attacker controlling any host to obtain credentials for other platform roles.