Critical, CVSS 9.9GoAmendedPublished
Logging operator has Fluentd configuration injection that allows remote code execution
CVE-2026-54680 · GHSA-mjqf-28ph-426h
- Affected
- Go github.com/kube-logging/logging-operator < 0.0.0-20260608145523-cf437d7f1e05
- Fixed in
- 0.0.0-20260608145523-cf437d7f1e05· Vendor fix available
- Issue
- The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path, a value in recordtransformer.records can close the current <record / <filter block and add a new <match block. By specifying Fluentd's core @type exec plugin in that injected block, an attacker can execute arbitrary commands inside the Fluentd aggregator. Details The issue is in FluentRender in pkg/sdk/logging/model/render/fluent.go. https://github.com/kube-logging/logging-operator/blob/98275d2984aa8d731c4c975b8006aa433fc7bafa/pkg/sdk/logging/model/render/fluent.go#L60-L87 Each parameter is rendered as key value, but values are not quoted, and newlines or characters such as < and are not rejected. In addition, indentedf builds the string with fmt.Sprintf and then splits it on \n, so…
Recommended action: Upgrade to 0.0.0-20260608145523-cf437d7f1e05 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.