CVE-2026-54680: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in kube-logging logging-operator
A critical injection vulnerability (CVE-2026-54680) exists in kube-logging logging-operator versions prior to 6.6.0. The Fluentd configuration renderer writes certain CRD strings directly into configuration files without proper escaping, allowing an attacker with permission to create Flow resources to inject malicious Fluentd <match **> blocks. This can lead to arbitrary command execution within the Fluentd aggregator. The issue is resolved in version 6.6.0.
AI Analysis
Technical Summary
The kube-logging logging-operator prior to version 6.6.0 contains an injection vulnerability due to improper neutralization of special elements in output used by the FluentRender component. Specifically, the Flow record_transformer.records values are written directly into fluent.conf without escaping, enabling a user who can create Flow resources to inject a Fluentd <match **> block using @type exec. This allows execution of arbitrary commands inside the Fluentd aggregator. The vulnerability is tracked as CVE-2026-54680 with a CVSS 3.1 score of 9.9, indicating critical severity. The vulnerability is fixed in version 6.6.0.
Potential Impact
An attacker with permissions to create Flow resources can exploit this vulnerability to execute arbitrary commands within the Fluentd aggregator, potentially leading to full compromise of the logging infrastructure, data exfiltration, or disruption of logging services. The vulnerability affects confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
Upgrade kube-logging logging-operator to version 6.6.0 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is confirmed fixed in 6.6.0.
CVE-2026-54680: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in kube-logging logging-operator
Description
A critical injection vulnerability (CVE-2026-54680) exists in kube-logging logging-operator versions prior to 6.6.0. The Fluentd configuration renderer writes certain CRD strings directly into configuration files without proper escaping, allowing an attacker with permission to create Flow resources to inject malicious Fluentd <match **> blocks. This can lead to arbitrary command execution within the Fluentd aggregator. The issue is resolved in version 6.6.0.
CVSS v3.1
Score 9.9critical
Affected software
kube-logging
logging-operator
pkg:github/kube-logging/logging-operatorRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The kube-logging logging-operator prior to version 6.6.0 contains an injection vulnerability due to improper neutralization of special elements in output used by the FluentRender component. Specifically, the Flow record_transformer.records values are written directly into fluent.conf without escaping, enabling a user who can create Flow resources to inject a Fluentd <match **> block using @type exec. This allows execution of arbitrary commands inside the Fluentd aggregator. The vulnerability is tracked as CVE-2026-54680 with a CVSS 3.1 score of 9.9, indicating critical severity. The vulnerability is fixed in version 6.6.0.
Potential Impact
An attacker with permissions to create Flow resources can exploit this vulnerability to execute arbitrary commands within the Fluentd aggregator, potentially leading to full compromise of the logging infrastructure, data exfiltration, or disruption of logging services. The vulnerability affects confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
Upgrade kube-logging logging-operator to version 6.6.0 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is confirmed fixed in 6.6.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T22:53:58.561Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a6a335f9c2644c7f8cc856b
Added to database: 07/29/2026, 17:07:43 UTC
Last enriched: 08/06/2026, 17:57:57 UTC
Last updated: 09/12/2026, 22:01:34 UTC
Views: 79
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.