Kube-logging Logging-operator vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Kube-logging Logging-operator: 1 record(s), with affected versions and fixes.
CVE-2026-54680
Critical · 9.9
CWE-74 Jul 29, 2026
Logging operator has Fluentd configuration injection that allows remote code execution
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.