Vulnerability · Published Jul 29, 2026 · Assigned by GitHub_M

CVE-2026-54680Logging operator has Fluentd configuration injection that allows remote code execution

Critical 9.9

In plain English

A critical-severity injection in logging-operator from kube-logging. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.8%top 43.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/kube-logging/logging-operator	0.0.0-20260608145523-cf437d7f1e05	GHSA-mjqf-28ph-426h
Go	github.com/kube-logging/logging-operator	0.0.0-20260608145523-cf437d7f1e05	GO-2026-6142

Affected products (as reported)

Vendor	Product	Versions
kube-logging	logging-operator	< 6.6.0

Weakness: CWE-74, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h x_refsource_CONFIRM
https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425 x_refsource_MISC
https://github.com/kube-logging/logging-operator/releases/tag/6.6.0 x_refsource_MISC