CVE-2026-54680
CRITICALLogging operator has Fluentd configuration injection that allows remote code execution
Title source: cnaDescription
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h
X_Refsource_Misc x_refsource_misc
https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425
X_Refsource_Misc x_refsource_misc
https://github.com/kube-logging/logging-operator/releases/tag/6.6.0
Scores
CVSS v3
9.9
EPSS
0.0043
EPSS Percentile
35.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-74
CWE-77
Status
published
Products (2)
kube-logging/logging-operator
0 - 0.0.0-20260608145523-cf437d7f1e05Go
kube-logging/logging-operator
< 6.6.0
Published
Jul 29, 2026
Tracked Since
Jul 29, 2026