150 matches found
OS Command Injection
github.com/kube-logging/logging-operator is vulnerable to OS Command Injection. The vulnerability is due to the Fluentd configuration renderer FluentRender writing unescaped CRD strings such as Flow recordtransformer.records values directly into fluent.conf, which allows an attacker with permissi...
CLEANSTART-2026-YA10976 Security fixes in kube-logging-operator 6.2.2-r0
Package kube-logging-operator version 6.2.2-r0 fixes 6 vulnerabilities: ghsa-mxw3-3hh2-x2mh, ghsa-jfh8-c2jp-hdph, ghsa-v9wx-v5z4-wgfj, ghsa-59gp-qqm7-cw4j, ghsa-g7gv-6qhm-4h2j...
PT-2026-86089
Package kube-logging-operator version 6.2.2-r0 fixes 6 vulnerabilities: ghsa-mxw3-3hh2-x2mh, ghsa-jfh8-c2jp-hdph, ghsa-v9wx-v5z4-wgfj, ghsa-59gp-qqm7-cw4j, ghsa-g7gv-6qhm-4h2j...
CVE-2026-54680
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...
Logging operator has Fluentd configuration injection that allows remote code execution
Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path...
CVE-2026-54680
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...
CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...
CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...
CVE-2026-54680
The CVE concerns the Kubernetes Logging Operator (Logging operator) where FluentRender (FluentRender) in Fluentd config rendering writes CRD values (e.g., Flow record_transformer.records) directly into fluent.conf without escaping. This allows a user who can create Flow resources to inject a blo...
CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...
EUVD-2026-50419
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...
CVE-2026-54680: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...
CVE-2026-54171 vulnerabilities
Vulnerabilities for packages: kube-logging-operator, cinc-auditor...
CVE-2026-54696 vulnerabilities
Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset, cinc-auditor...
GHSA-48RX-C7PG-Q66R vulnerabilities
Vulnerabilities for packages: kube-logging-operator, cinc-auditor...
GHSA-X2F5-4PRF-W687 vulnerabilities
Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset, cinc-auditor...
CVE-2026-54171 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, commercial-gitlab-rails-ee-fips, commercial-gitlab-rails-ee, gitlab-rails-ce-fips, cinc-auditor, kube-logging-operator...
GHSA-48RX-C7PG-Q66R vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, commercial-gitlab-rails-ee-fips, commercial-gitlab-rails-ee, gitlab-rails-ce-fips, cinc-auditor, kube-logging-operator...
GHSA-X2F5-4PRF-W687 vulnerabilities
Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, pghero, gitlab-rails-ce, commercial-gitlab-rails-ee-fips, pghero-fips, logstash, commercial-gitlab-rails-ee, gitlab-rails-ce-fips, cinc-auditor, kube-logging-operator, pact-broker-docker...
CVE-2026-54696 vulnerabilities
Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, pghero, gitlab-rails-ce, commercial-gitlab-rails-ee-fips, pghero-fips, logstash, commercial-gitlab-rails-ee, gitlab-rails-ce-fips, cinc-auditor, kube-logging-operator, pact-broker-docker...