Threats affecting pkg:github/kube-logging/logging-operator

A critical injection vulnerability (CVE-2026-54680) exists in kube-logging logging-operator versions prior to 6.6.0. The Fluentd configuration renderer writes certain CRD strings directly into configuration files without proper escaping, allowing an attacker with permission to create Flow resources to inject malicious Fluentd <match **> blocks. This can lead to arbitrary command execution within the Fluentd aggregator. The issue is resolved in version 6.6.0.

Insecure permissions in logging-operator v4.6.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.