Kube-logging vulnerabilities
Published CVEs affecting Kube-logging products: 1 record(s), with severity, exploitation and fixes.
CVE-2026-54680
Critical · 9.9
CWE-74 Jul 29, 2026
Logging operator has Fluentd configuration injection that allows remote code execution
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.