OpenShift Cluster Logging Operator missing authorization flaw

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609 Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609

The vulnerability CVE-2026-10609 affects the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, enabling a delegated editor to exfiltrate...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

GHSA-5V8H-3H3Q-446P vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, pact-broker-docker-fips, ruby3.2-rails, commercial-gitlab-rails-ee, kube-logging-operator, logstash, logstash-fips, ruby3.3-rails, gitlab-rails-ce, ruby4.0-rails, pact-broker-docker...

GHSA-9CV2-CFXC-V4V2 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, pact-broker-docker-fips, ruby3.2-rails, commercial-gitlab-rails-ee, kube-logging-operator, logstash, logstash-fips, ruby3.3-rails, gitlab-rails-ce, ruby4.0-rails, pact-broker-docker...

GHSA-P67V-3W7G-WJG7 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, pact-broker-docker-fips, ruby3.2-rails, commercial-gitlab-rails-ee, kube-logging-operator, logstash, logstash-fips, ruby3.3-rails, gitlab-rails-ce, ruby4.0-rails, pact-broker-docker...

GHSA-PHWJ-RPRQ-35PP vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, pact-broker-docker-fips, ruby3.2-rails, commercial-gitlab-rails-ee, kube-logging-operator, logstash, logstash-fips, ruby3.3-rails, gitlab-rails-ce, ruby4.0-rails, pact-broker-docker...

GHSA-WFPW-MMFH-QQ69 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, pact-broker-docker-fips, ruby3.2-rails, commercial-gitlab-rails-ee, kube-logging-operator, logstash, logstash-fips, ruby3.3-rails, gitlab-rails-ce, ruby4.0-rails, pact-broker-docker...

GHSA-5PRR-V3J2-97MH vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, pact-broker-docker-fips, ruby3.2-rails, commercial-gitlab-rails-ee, kube-logging-operator, logstash, logstash-fips, ruby3.3-rails, gitlab-rails-ce, ruby4.0-rails, pact-broker-docker...

GHSA-8678-W3JW-XFC2 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, pact-broker-docker-fips, ruby3.2-rails, commercial-gitlab-rails-ee, kube-logging-operator, logstash, logstash-fips, ruby3.3-rails, gitlab-rails-ce, ruby4.0-rails, pact-broker-docker...

GHSA-WJV4-X9W8-WM3H vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, pact-broker-docker-fips, ruby3.2-rails, commercial-gitlab-rails-ee, kube-logging-operator, logstash, logstash-fips, ruby3.3-rails, gitlab-rails-ce, ruby4.0-rails, pact-broker-docker...

CVE-2026-10609: Missing Authorization

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

GHSA-CXH2-4639-VMC5 vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

CVE-2026-47701 vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

GHSA-CXH2-4639-VMC5 vulnerabilities

Vulnerabilities for packages: kube-logging-operator-fips, kube-logging-operator...

CVE-2026-47701 vulnerabilities

Vulnerabilities for packages: kube-logging-operator-fips, kube-logging-operator...

PT-2026-114467

Уязвимость компонента FluentRender контроллера логирования logging-operator сборщика данных Fluent Fluentd связана с неверной нейтрализация особых элементов в выходных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...