CVE-2026-54680: Remote Code Execution via Fluentd Configuration Injection in Logging Operator
Vulnerability ID: CVE-2026-54680
CVSS Score: 9.9
Published: 2026-07-29
A critical security flaw (CVE-2026-54680) in the Kubernetes Logging Operator allows authenticated attackers with namespace-level access to craft malicious Custom Resources that inject arbitrary configuration directives into the downstream Fluentd logging aggregator, resulting in unauthenticated remote code execution (RCE) in the context of the aggregator pod.
TL;DR
Authenticated users with Flow or ClusterFlow creation rights can inject newlines into Logging Operator Custom Resources, enabling downstream Fluentd configuration manipulation and arbitrary command execution.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-74, CWE-77
- Attack Vector: Network
- CVSS Score: 9.9 (Critical)
- Exploit Status: PoC Available
- Scope: Changed
- Privileges Required: Low
- Impact: Remote Code Execution (RCE)
Affected Systems
- kube-logging/logging-operator
-
Logging Operator: < 6.6.0 (Fixed in:
6.6.0)
Code Analysis
Commit: cf437d7
Fix configuration injection vulnerability by escaping and validating Fluentd parameters and block directives.
Mitigation Strategies
- Upgrade Logging Operator to 6.6.0 or higher.
- Implement Kubernetes Admission Controller validation policies.
- Deploy Fluentd with restricted Pod Security Standards.
Remediation Steps:
- Identify all namespaces with Logging Operator deployments.
- Check current versions of the logging-operator controller.
- Update helm charts or deployment manifests to pull version 6.6.0.
- Deploy Kyverno or OPA policies to block invalid newline characters in Flow and Output resources.
References
Read the full report for CVE-2026-54680 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)