PT-2026-65853 · Unknown+1 · Logging-Operator+1

CVE-2026-54680 · Published 2026-07-29 · Updated 2026-07-29

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Logging operator versions prior to 6.6.0

Description The Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes Custom Resource Definition (CRD) strings directly into the fluent.conf file without proper escaping. A user with permissions to create Flow resources can exploit this by providing values containing newlines in the record transformer.records variable. This allows the injection of a Fluentd <match **> block using the @type exec plugin, enabling the execution of arbitrary commands inside the Fluentd aggregator. This can lead to remote code execution (RCE) against the shared aggregator, potentially allowing an attacker to access sensitive information such as the node's Instance Metadata Service (IMDS) in cloud environments.

Recommendations Update Logging operator to version 6.6.0. As a temporary mitigation, restrict user permissions to prevent the creation of Flow resources by untrusted users.

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-54680

GHSA-MJQF-28PH-426H

Affected Products

Fluentd

Logging-Operator

References · 6

• https://osv.dev/vulnerability/GHSA-mjqf-28ph-426h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54680 · Security Note
• https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h · Note
• https://github.com/kube-logging/logging-operator · Note
• https://github.com/kube-logging/logging-operator/releases/tag/6.6.0 · Note
• https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425 · Note