CVE-2026-10609 describes a missing authorization flaw in the OpenShift Cluster Logging Operator component of Red Hat OpenShift. The operator improperly forwards ServiceAccount tokens to output destinations without validating that the ClusterLogForwarder creator is authorized to use those credentials. This lack of authorization checking enables a delegated editor to obtain ServiceAccount tokens illicitly, potentially escalating their privileges within the cluster environment. The vulnerability has a CVSS 3.1 base score of 6.8, indicating a medium severity level. No patch or official remediation level has been stated in the vendor advisory, and no known exploits in the wild have been reported as of the publication date.

An attacker with delegated editor permissions can exploit this vulnerability to exfiltrate ServiceAccount tokens. This can lead to privilege escalation within the OpenShift cluster, potentially allowing unauthorized access to sensitive resources or operations. The impact is limited to confidentiality (high impact on confidentiality), with no direct integrity or availability impact reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-10609 for current remediation guidance. Until an official fix is available, restrict delegated editor permissions carefully and monitor for unauthorized use of ServiceAccount tokens. Follow vendor guidance once updates or patches are released.