GHSA-9XM2-GW56-WJ7M OpenShift Cluster Logging Operator missing authorization flaw

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609 Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609 Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

EUVD-2026-38448

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609

The vulnerability CVE-2026-10609 affects the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, enabling a delegated editor to exfiltrate...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

GHSA-WFPW-MMFH-QQ69 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.4-rails, pact-broker-docker, logstash, pact-broker-docker-fips, gitlab-rails-ce, ruby4.0-rails, logstash-fips, ruby3.3-rails, ruby3.2-rails...

GHSA-PHWJ-RPRQ-35PP vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.4-rails, pact-broker-docker, logstash, pact-broker-docker-fips, gitlab-rails-ce, ruby4.0-rails, logstash-fips, ruby3.3-rails, ruby3.2-rails...

GHSA-8678-W3JW-XFC2 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.4-rails, pact-broker-docker, logstash, pact-broker-docker-fips, gitlab-rails-ce, ruby4.0-rails, logstash-fips, ruby3.3-rails, ruby3.2-rails...

GHSA-5V8H-3H3Q-446P vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.4-rails, pact-broker-docker, logstash, pact-broker-docker-fips, gitlab-rails-ce, ruby4.0-rails, logstash-fips, ruby3.3-rails, ruby3.2-rails...

GHSA-WJV4-X9W8-WM3H vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.4-rails, pact-broker-docker, logstash, pact-broker-docker-fips, gitlab-rails-ce, ruby4.0-rails, logstash-fips, ruby3.3-rails, ruby3.2-rails...

GHSA-9CV2-CFXC-V4V2 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.4-rails, pact-broker-docker, logstash, pact-broker-docker-fips, gitlab-rails-ce, ruby4.0-rails, logstash-fips, ruby3.3-rails, ruby3.2-rails...

GHSA-5PRR-V3J2-97MH vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.4-rails, pact-broker-docker, logstash, pact-broker-docker-fips, gitlab-rails-ce, ruby4.0-rails, logstash-fips, ruby3.3-rails, ruby3.2-rails...

GHSA-P67V-3W7G-WJG7 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.4-rails, pact-broker-docker, logstash, pact-broker-docker-fips, gitlab-rails-ce, ruby4.0-rails, logstash-fips, ruby3.3-rails, ruby3.2-rails...

SUSE CVE-2026-12725

A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply su...

PT-2026-51592

Name of the Vulnerable Software and Affected Versions foreman-mcp-server affected versions not specified Description Two distinct logging mechanisms in the software can expose sensitive session and authentication data. One mechanism logs session identifiers, which function as authentication...

Fixed in Apache Tomcat 9.0.119

Moderate: Security constraints for default servlet ignored method CVE-2026-55956 If security constraints were specified for the default servlet, any method or method omission configured as part of the constraint was ignored. This was fixed with commit a0374c45. This issue was reported to the Tomc...

PT-2026-51588

Name of the Vulnerable Software and Affected Versions foreman-mcp-server affected versions not specified Red Hat Satellite affected versions not specified Description A session management issue in the MCP Server allows unauthenticated attackers to hijack active administrative sessions. This occur...