CVE-2026-72640 is a privilege escalation in Elastic Cloud on Kubernetes (ECK) where the operator trusts annotation contents as authorization tokens, allowing any user who can create or update secrets in their own namespace to exfiltrate secrets from any namespace in the cluster. The CVSS score of 6.5 badly undersells the risk—this is a design flaw, not a misconfiguration.
The ECK operator requires cluster-wide secret permissions because Elasticsearch cross-namespace topologies demand it. But the operator then accepts namespace identifiers from annotations that namespace-limited users can write. This inverts Kubernetes' security model: RBAC restricts what users can do, but this vulnerability lets a user's annotation payload hijack the operator's elevated permissions to bypass those restrictions entirely. It's an Insecure Direct Object Reference applied to namespace boundaries—the operator never asks 'is this user authorized to access this secret in this namespace?' It parses the annotation and acts with its own service account credentials.
The exploit surface is narrow—users need create/update permission on secrets in their own namespace—but the impact is unbounded secret exfiltration across the cluster. In typical multi-tenant clusters running ECK, this means dozens of namespaces become accessible to any user who can annotate a secret in their assigned namespace.
The deeper concern: operator-sdk based controllers frequently read annotations as configuration to drive behavior. The SDK teaches this pattern without making salient that annotation contents from low-privilege users are untrusted input requiring the same validation as HTTP parameters or deserialized payloads. If other operators implement annotation-driven secret copying or privileged actions without re-verifying authorization, they inherit this flaw. Elastic has patched this instance, but the question of whether similar patterns exist in other operators—particularly those installed via Helm, Terraform, or GitOps—remains open.
Audit your cluster for operators with cluster-scoped secret permissions that also read user-controllable annotations. The patch quality matters: determine whether it adds explicit user-level authorization checks at reconciliation time or merely sanitizes annotation syntax. The former eliminates the architectural flaw; the latter is a temporary reduction in exploitability that may be bypassed.