by Kastro
Paper/Archive/CVE-2026-54680

CVE-2026-54680

kube-logging logging-operator — Logging operator has Fluentd configuration injection that allows remote code execution

EPSS 0.8%public exploitCVSS 9.9
critical.is priorityof 100
51
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 56.1.561 × 2011.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.

Affected

ProductAffectedFixed inSource
logging-operator< 6.6.0–CNA

Scores by source

GitHub_M (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426hrefgithub.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425refgithub.com/kube-logging/logging-operator/releases/tag/6.6.0