CVE-2026-79770 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, gitlab-rails-ce-fips, pact-broker-docker-fips, ruby3.2-rails, kube-logging-operator, ruby3.3-rails, gitlab-rails-ce, ruby4.0-rails, pact-broker-docker...

CVE-2026-79770 vulnerabilities

Vulnerabilities for packages: ruby4.0-rails, ruby3.2-rails, ruby3.4-rails, kube-logging-operator, ruby3.3-rails...

CVE-2026-79771 vulnerabilities

Vulnerabilities for packages: ruby4.0-rails, ruby3.2-rails, ruby3.4-rails, kube-logging-operator, ruby3.3-rails...

GHSA-5JHF-FPP7-V2PV vulnerabilities

Vulnerabilities for packages: ruby4.0-rails, ruby3.2-rails, ruby3.4-rails, kube-logging-operator, ruby3.3-rails...

GO-2026-6142 Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator

Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator...

PT-2026-80386

Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator...

GO-2026-5339 vulnerabilities

Vulnerabilities for packages: kube-logging-operator-fips, kube-logging-operator...

GO-2026-5339 vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: kubescape, podinfo, dbmate, gomplate, kapp-controller, kiali, vault-benchmark, nri-mssql, gke-gcloud-auth-plugin, terraform-provider-azurerm, cortex, knative-serving, chisel, nri-haproxy, temporal-server, kubernetes-csi-livenessprobe, libnvidia-container,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: minio, podinfo, maru, dbmate, dockerize, kapp-controller, vault-benchmark, gke-gcloud-auth-plugin, kustomize, cortex, nri-haproxy, chisel, verticadb-operator, postgres-operator, kubernetes-csi-livenessprobe, fluxcd-kustomize-mutating-webhook, rabbitmq-cluster-operato...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: pluto, kapp-controller, kubernetes-dashboard-auth, chartmuseum, falcoctl, nri-haproxy, kpt, cluster-api-provider-vsphere, glow, libnvidia-container, rabbitmq-cluster-operator, opa, cilium-cli, rancher-system-upgrade-controller, steampipe, bom, flux, wait-for-port,...

CLEANSTART-2026-KD98941 Security fixes in kube-logging-operator 6.6.0-r1

Package kube-logging-operator version 6.6.0-r1 fixes 4 vulnerabilities: CVE-2026-47701, ghsa-cxh2-4639-vmc5, ghsa-hrxh-6v49-42gf, CVE-2026-46600...

CLEANSTART-2026-TQ54429 Security fixes in kube-logging-operator 6.7.0-r2

Package kube-logging-operator version 6.7.0-r2 fixes 9 vulnerabilities: CVE-2026-56852, CVE-2026-46600, CVE-2026-44024, CVE-2026-44025, CVE-2026-44160...

CLEANSTART-2026-QW78358 Security fixes in kube-logging-operator 6.4.0-r1

Package kube-logging-operator version 6.4.0-r1 fixes 4 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3, ghsa-hrxh-6v49-42gf, CVE-2026-33814...

CLEANSTART-2026-TD71000 Security fixes in kube-logging-operator 6.5.2-r1

Package kube-logging-operator version 6.5.2-r1 fixes 4 vulnerabilities: CVE-2026-47701, ghsa-cxh2-4639-vmc5, ghsa-hrxh-6v49-42gf, CVE-2026-46600...

OS Command Injection

github.com/kube-logging/logging-operator is vulnerable to OS Command Injection. The vulnerability is due to the Fluentd configuration renderer FluentRender writing unescaped CRD strings such as Flow recordtransformer.records values directly into fluent.conf, which allows an attacker with permissi...

CLEANSTART-2026-YA10976 Security fixes in kube-logging-operator 6.2.2-r0

Package kube-logging-operator version 6.2.2-r0 fixes 6 vulnerabilities: ghsa-mxw3-3hh2-x2mh, ghsa-jfh8-c2jp-hdph, ghsa-v9wx-v5z4-wgfj, ghsa-59gp-qqm7-cw4j, ghsa-g7gv-6qhm-4h2j...

PT-2026-86089

Package kube-logging-operator version 6.2.2-r0 fixes 6 vulnerabilities: ghsa-mxw3-3hh2-x2mh, ghsa-jfh8-c2jp-hdph, ghsa-v9wx-v5z4-wgfj, ghsa-59gp-qqm7-cw4j, ghsa-g7gv-6qhm-4h2j...

CVE-2026-54680

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

Logging operator has Fluentd configuration injection that allows remote code execution

Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path...