416 matches found
OS Command Injection
github.com/kube-logging/logging-operator is vulnerable to OS Command Injection. The vulnerability is due to the Fluentd configuration renderer FluentRender writing unescaped CRD strings such as Flow recordtransformer.records values directly into fluent.conf, which allows an attacker with permissi...
CLEANSTART-2026-ZB89546 Security fixes in ruby-fluentd-1.19 1.19.2-r3
Package ruby-fluentd-1.19 version 1.19.2-r3 fixes 9 vulnerabilities: ghsa-h8w8-99g7-qmvj, ghsa-6wx8-w4f5-wwcr, ghsa-wv3x-4vxv-whpp, CVE-2026-54904, CVE-2026-54905...
CVE-2026-54680
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...
Logging operator has Fluentd configuration injection that allows remote code execution
Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path...
GHSA-MJQF-28PH-426H Logging operator has Fluentd configuration injection that allows remote code execution
Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path...
CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...
CVE-2026-54680
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...
CVE-2026-54680
The CVE concerns the Kubernetes Logging Operator (Logging operator) where FluentRender (FluentRender) in Fluentd config rendering writes CRD values (e.g., Flow record_transformer.records) directly into fluent.conf without escaping. This allows a user who can create Flow resources to inject a blo...
EUVD-2026-50419
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...
CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...
CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...
CVE-2026-54680
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...
CVE-2026-54680: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...
CVE-2026-46600 vulnerabilities
Vulnerabilities for packages: spicedb-operator, kaf, dataplaneapi, istio, minio, amazon-cloudwatch-agent-operator, k6, flux-kustomize-controller, rancher-fleet, bento, syft, loki, kyverno, terragrunt, kubernetes, kustomize, opentelemetry-collector, pgtimetable, elvish, rancher-agent,...
GHSA-GG3M-VVP2-P2C5 vulnerabilities
Vulnerabilities for packages: spicedb-operator, kaf, dataplaneapi, istio, minio, amazon-cloudwatch-agent-operator, k6, flux-kustomize-controller, rancher-fleet, bento, syft, loki, kyverno, terragrunt, kubernetes, kustomize, opentelemetry-collector, pgtimetable, elvish, rancher-agent,...
GHSA-GG3M-VVP2-P2C5 vulnerabilities
Vulnerabilities for packages: pulumi-language-yaml, gitlab-kas, commercial-grafana, flagger-fips, kube-router-fips, karpenter, kustomize, mediamtx, flux-notification-controller-fips, pguser, syncthing-fips, ko-fips, fulcio-fips, knative-eventing-fips, aws-nuke-fips, buildkite-agent, kubo,...
CVE-2026-46600 vulnerabilities
Vulnerabilities for packages: pulumi-language-yaml, gitlab-kas, commercial-grafana, flagger-fips, kube-router-fips, karpenter, kustomize, mediamtx, flux-notification-controller-fips, pguser, syncthing-fips, ko-fips, fulcio-fips, knative-eventing-fips, aws-nuke-fips, buildkite-agent, kubo,...
Critical Photon OS Security Update - PHSA-2026-5.0-0927
Updates of 'rubygem-fluentd' packages of Photon OS have been released...
Critical Photon OS Security Update - PHSA-2026-5.0-92-0927
Updates of 'rubygem-fluentd' packages of Photon OS have been released...
CLEANSTART-2026-RG00675 Security fixes for CVE-2026-33637, CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, ghsa-5rv5-xj5j-3484, ghsa-75xq-5h9v-w6px, ghsa-87pf-fpwv-p7m7, ghsa-hm49-wcqc-g2xg, ghsa-q2mw-fvj9-vvcw, ghsa-vcgp-9326-pqcp applied in versions: 1.19.2-r2
Multiple security vulnerabilities affect the ruby-fluentd-1.19 package. These issues are resolved in later releases. See references for individual vulnerability details...