Logging operator has Fluentd configuration injection that allows remote code execution

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54680 · Microsoft / collected KEV context

GHSA-mjqf-28ph-426h

GO-2026-6142

cve-program · CVE-2026-54680

• https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h
• https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425
• https://github.com/kube-logging/logging-operator/releases/tag/6.6.0

nvd · CVE-2026-54680

• https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425
• https://github.com/kube-logging/logging-operator/releases/tag/6.6.0
• https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h

osv · GHSA-mjqf-28ph-426h

• https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h
• https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425
• https://github.com/kube-logging/logging-operator
• https://github.com/kube-logging/logging-operator/releases/tag/6.6.0

osv · GO-2026-6142

• https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h
• https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425
• https://github.com/kube-logging/logging-operator/releases/tag/6.6.0

No related operational record is retained in the current change model.