{"id":"CVE-2026-54680","title":"Logging operator automates the deployment and configuration of Kubernetes logging pipelines","summary":"Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record…","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-74","CWE-77"],"vendor":"kube-logging","product":"github.com/kube-logging/logging-operator","affected":["github.com/kube-logging/logging-operator < 0.0.0-20260608145523-cf437d7f1e05"],"patched":["github.com/kube-logging/logging-operator 0.0.0-20260608145523-cf437d7f1e05"],"published":"2026-07-29","updated":"2026-09-10","sourceUpdated":"2026-09-10T20:12:43.783","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54680","references":[{"url":"https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425","label":"security-advisories@github.com"},{"url":"https://github.com/kube-logging/logging-operator/releases/tag/6.6.0","label":"security-advisories@github.com"},{"url":"https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h","label":"security-advisories@github.com"},{"url":"https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-mjqf-28ph-426h"}],"tags":["nvd","ghsa","go"],"epss":0.00525,"epssPercentile":0.43484,"aliases":["GHSA-mjqf-28ph-426h"],"ecosystem":"go","ingestedAt":"2026-07-29T17:48:50.120Z","slug":"CVE-2026-54680","body":"## Overview\n\nLogging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54680)\n\nAffected packages:\n\n- `github.com/kube-logging/logging-operator < 0.0.0-20260608145523-cf437d7f1e05`\n\nPatched in:\n\n- `github.com/kube-logging/logging-operator 0.0.0-20260608145523-cf437d7f1e05`\n\nSource: https://github.com/advisories/GHSA-mjqf-28ph-426h","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":54.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}