This advisory covers multiple security vulnerabilities affecting Red Hat OpenShift Logging, version 6.4.6, a cluster-wide logging solution for OpenShift. The vulnerabilities include a range of CWEs such as CWE-79 (Cross-site Scripting), CWE-606 (Unchecked Input for Loop Condition), and others indicating issues like improper input validation, resource management, and potential denial of service. The advisory references ten CVEs including CVE-2026-25681 and others, indicating a broad set of security fixes. Red Hat has released version 6.4.6 to address these issues and provides documentation for upgrading OpenShift Container Platform 4.20 and OpenShift Logging 6.4 to apply these fixes.

The vulnerabilities collectively pose a high severity risk to the Red Hat OpenShift Logging subsystem, potentially allowing attackers to exploit issues such as cross-site scripting, improper input validation, and resource exhaustion. These could lead to unauthorized actions, denial of service, or other impacts on the confidentiality, integrity, or availability of the logging infrastructure. No known exploits in the wild have been reported at this time.

Red Hat has released an updated version, OpenShift Logging 6.4.6, which addresses these vulnerabilities. Users should follow the official Red Hat documentation to upgrade their OpenShift Container Platform clusters and apply the 6.4.6 update to the logging subsystem. The advisory provides detailed upgrade instructions at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes and https://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4. Applying these updates fully mitigates the identified vulnerabilities.