---
id: CVE-2026-10609
aliases:
  - GHSA-9xm2-gw56-wj7m
title: OpenShift Cluster Logging Operator missing authorization flaw
summary: OpenShift Cluster Logging Operator missing authorization flaw
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N'
vendor: openshift
product: github.com/openshift/cluster-logging-operator
ecosystem: go
affected:
  - >-
    github.com/openshift/cluster-logging-operator <
    0.0.0-20260804174055-1864c2a9851d
patched:
  - >-
    github.com/openshift/cluster-logging-operator
    0.0.0-20260804174055-1864c2a9851d
published: '2026-06-23'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T19:15:05.671488050Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-9xm2-gw56-wj7m'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-10609'
  - url: 'https://github.com/openshift/cluster-logging-operator/pull/3383'
  - url: >-
      https://github.com/openshift/cluster-logging-operator/commit/1864c2a9851da90a3956f1b83c5f31b3b76e3514
  - url: 'https://access.redhat.com/security/cve/CVE-2026-10609'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2483943'
  - url: 'https://github.com/openshift/cluster-logging-operator'
  - url: 'https://github.com/advisories/GHSA-9xm2-gw56-wj7m'
tags:
  - osv
  - go
  - ghsa
epss: 0.00375
epssPercentile: 0.28625
cwe:
  - CWE-862
ingestedAt: '2026-09-24T19:50:30.724Z'
---

## Overview

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

## Affected packages

- `github.com/openshift/cluster-logging-operator < 0.0.0-20260804174055-1864c2a9851d`

## Remediation

Upgrade to a patched release:

- `github.com/openshift/cluster-logging-operator 0.0.0-20260804174055-1864c2a9851d`