CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

CVE-2026-54680

The CVE concerns the Kubernetes Logging Operator (Logging operator) where FluentRender (FluentRender) in Fluentd config rendering writes CRD values (e.g., Flow record_transformer.records) directly into fluent.conf without escaping. This allows a user who can create Flow resources to inject a blo...

CVE-2026-54680

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

EUVD-2026-50419

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

CVE-2026-54680: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

CVE-2026-54696 vulnerabilities

Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, cinc-auditor, kube-logging-operator...

GHSA-48RX-C7PG-Q66R vulnerabilities

Vulnerabilities for packages: cinc-auditor, kube-logging-operator...

GHSA-X2F5-4PRF-W687 vulnerabilities

Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, cinc-auditor, kube-logging-operator...

CVE-2026-54171 vulnerabilities

Vulnerabilities for packages: cinc-auditor, kube-logging-operator...

CVE-2026-54171 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, kube-logging-operator, commercial-gitlab-rails-ee-fips, commercial-gitlab-rails-ee, cinc-auditor...

GHSA-X2F5-4PRF-W687 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, kube-logging-operator, pghero, commercial-gitlab-rails-ee-fips, commercial-gitlab-rails-ee, pghero-fips, cinc-auditor, logstash, pact-broker-docker, ruby3.2-fluentd-kubernetes-daemonset...

CVE-2026-54696 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, kube-logging-operator, pghero, commercial-gitlab-rails-ee-fips, commercial-gitlab-rails-ee, pghero-fips, cinc-auditor, logstash, pact-broker-docker, ruby3.2-fluentd-kubernetes-daemonset...

GHSA-48RX-C7PG-Q66R vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, kube-logging-operator, commercial-gitlab-rails-ee-fips, commercial-gitlab-rails-ee, cinc-auditor...

CVE-2026-44162 vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

GHSA-XV9W-7V6Q-HPJH vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

CVE-2026-44162 vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

GHSA-XV9W-7V6Q-HPJH vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

GHSA-9XM2-GW56-WJ7M OpenShift Cluster Logging Operator missing authorization flaw

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...