Read the docs
TI-2026-39502 Aliases CVE-2026-54680GHSA-mjqf-28ph-426h

Logging operator has Fluentd configuration injection that allows remote code execution

Priority HIGH 76CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00785 56th percentileScored 2026-11-07
Fix Fixed logging-operator (kube-logging): 6.6.0github.com/kube-logging/logging-operator (Go): 0.0.0-20260608145523-cf437d7f1e05

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kube-logginglogging-operatorbefore 6.6.06.6.0Patch availableCNA
—github.com/kube-logging/logging-operator (Go)before 0.0.0-20260608145523-cf437d7f1e050.0.0-20260608145523-cf437d7f1e05Patch availableGHSA-mjqf-28ph-426h
  • logging-operator Vendorkube-logging Affected before 6.6.0 Fixed in 6.6.0 Patch available CNA
  • github.com/kube-logging/logging-operator (Go) Vendor— Affected before 0.0.0-20260608145523-cf437d7f1e05 Fixed in 0.0.0-20260608145523-cf437d7f1e05 Patch available GHSA-mjqf-28ph-426h

Remediation

  • Fix · CNA logging-operator (kube-logging) Fixed in 6.6.0
  • Fix · GHSA-mjqf-28ph-426h github.com/kube-logging/logging-operator (Go) Fixed in 0.0.0-20260608145523-cf437d7f1e05 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54680
  2. 2026-10-03 Alias added: GHSA-mjqf-28ph-426h

References

Other 4

  • TI-2024-24310 Insecure permissions in logging-operator v4.6.0 allows attackers to access sensitive data… CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences