PT-2026-51518 · Red Hat · Logging Subsystem For Red Hat Openshift

Publicado 2026-06-23 · Atualizado 2026-06-23 · CVE-2026-10609

Mitre

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-10609

Produtos afetados

Logging Subsystem For Red Hat Openshift

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-10609 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=2483943 · Nota
• https://access.redhat.com/security/cve/CVE-2026-10609 · Nota