CVE-2026-54680
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.53%
- CWE
- CWE-74, CWE-77
- Published
- 2026-07-29
- Last modified
- 2026-07-30
Affected products
- kube-logging logging-operator
Weakness type
Related vulnerabilities
- CVE-2026-87572 — Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer
- CVE-2026-82971 — QVidium Opera11 CGI Script net_tr.cgi command injection
- CVE-2026-20130 — Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities
- CVE-2026-12351 — IBM MQ is vulnerable to unauthenticated remote code execution via JNDI injection
- CVE-2026-79697 — Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection
- CVE-2026-79698 — Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection
- CVE-2026-79234 — Injection in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain sensitive infor
- CVE-2026-83772 — Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection