CVE-2026-54680
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Logging operator before version 6.6.0 has a command injection vulnerability in the Fluentd configuration renderer. A user who can create Flow resources can inject a <match **> block with @type exec to execute arbitrary commands in the Fluentd aggregator.
Risk Assessment
An attacker can execute arbitrary commands in the Fluentd container, potentially leading to compromise of log processing and the entire Kubernetes cluster.
Recommendation
Update Logging operator to version 6.6.0 or later, which fixes this vulnerability.
Original NVD description (English source)
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.