Critical Photon OS Security Update - PHSA-2026-5.0-91-0960

Updates of 'go', 'alsa-lib', 'rubygem-fluentd', 'coreutils' packages of Photon OS have been released...

GO-2025-4188 vulnerabilities

Vulnerabilities for packages: sonobuoy, newrelic-nri-statsd, kpt, neuvector-dbgen, terraform-provider-google, aws-flb-cloudwatch, kube-fluentd-operator, kubeflow, smokescreen, src-fingerprint, php-fpmexporter, aws-flb-firehose, go-discover, docker-credential-gcr, hello-world-golang, gostatsd,...

GHSA-4MRV-5P47-P938 vulnerabilities

Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, kube-logging-operator...

CVE-2026-54522 vulnerabilities

Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, kube-logging-operator...

CVE-2026-54522 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset...

GHSA-4MRV-5P47-P938 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset...

CVE-2026-54680

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

Logging operator has Fluentd configuration injection that allows remote code execution

Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path...

GHSA-MJQF-28PH-426H Logging operator has Fluentd configuration injection that allows remote code execution

Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path...

CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

CVE-2026-54680

The CVE concerns the Kubernetes Logging Operator (Logging operator) where FluentRender (FluentRender) in Fluentd config rendering writes CRD values (e.g., Flow record_transformer.records) directly into fluent.conf without escaping. This allows a user who can create Flow resources to inject a blo...

GHSA-GG3M-VVP2-P2C5 vulnerabilities

Vulnerabilities for packages: rancher-agent, kubernetes, crossplane-provider-keycloak, telegraf, cilium, gitlab-kas, azurefile-csi, flux-source-controller, seaweedfs, pulumi-language-java, opentelemetry-collector-contrib, flux-image-reflector-controller, kitty, flux-image-automation-controller,...

CVE-2026-46600 vulnerabilities

Vulnerabilities for packages: rancher-agent, kubernetes, crossplane-provider-keycloak, telegraf, cilium, gitlab-kas, azurefile-csi, flux-source-controller, seaweedfs, pulumi-language-java, opentelemetry-collector-contrib, flux-image-reflector-controller, kitty, flux-image-automation-controller,...

GHSA-GG3M-VVP2-P2C5 vulnerabilities

Vulnerabilities for packages: frankenphp-8.4, kine, sftpgo-plugin-pubsub, opentelemetry-collector-contrib-fips, snyk-cli, crossplane-provider-aws-fis-fips, task, vexctl, gitlab-operator-fips, minio, cloudnative-pg, kyverno, terragrunt, consul, jfrog-cli, seaweedfs-rocksdb-fips, cilium-cli,...

CVE-2026-46600 vulnerabilities

Vulnerabilities for packages: frankenphp-8.4, kine, sftpgo-plugin-pubsub, opentelemetry-collector-contrib-fips, snyk-cli, crossplane-provider-aws-fis-fips, task, vexctl, gitlab-operator-fips, minio, cloudnative-pg, kyverno, terragrunt, consul, jfrog-cli, seaweedfs-rocksdb-fips, cilium-cli,...

Critical Photon OS Security Update - PHSA-2026-5.0-92-0927

Updates of 'rubygem-fluentd' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2026-5.0-0927

Updates of 'rubygem-fluentd' packages of Photon OS have been released...

CLEANSTART-2026-RG00675 Security fixes for CVE-2026-33637, CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, ghsa-5rv5-xj5j-3484, ghsa-75xq-5h9v-w6px, ghsa-87pf-fpwv-p7m7, ghsa-hm49-wcqc-g2xg, ghsa-q2mw-fvj9-vvcw, ghsa-vcgp-9326-pqcp applied in versions: 1.19.2-r2

Multiple security vulnerabilities affect the ruby-fluentd-1.19 package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DE16221 Security fixes for CVE-2026-54171, CVE-2026-54297, CVE-2026-54522, CVE-2026-54904, CVE-2026-54905, CVE-2026-54906, ghsa-6wx8-w4f5-wwcr, ghsa-98m9-hrrm-r99r, ghsa-h8w8-99g7-qmvj, ghsa-wv3x-4vxv-whpp applied in versions: 1.18.0-r4, 1.18.0-r5

Multiple security vulnerabilities affect the ruby-fluentd-1.18 package. These issues are resolved in later releases. See references for individual vulnerability details...