Executive brief
The OpenShift Cluster Logging Operator, which manages how logs are collected and sent to storage, contains a security flaw in how it handles authentication tokens. An attacker with permission to configure log forwarding can trick the system into sending sensitive service account tokens to an external server they control. This could allow the attacker to steal high-level credentials and gain unauthorized access to other parts of the OpenShift cluster.
Technical details
A missing authorization flaw (CWE-862) exists in the OpenShift Cluster Logging Operator's handling of ClusterLogForwarder (CLF) resources. The operator creates 'kubernetes.io/service-account-token' Secrets and forwards them as bearer tokens to output destinations without verifying if the CLF creator has permission to use the referenced ServiceAccount. An attacker with write access to CLF resources can bypass SubjectAccessReview (SAR) checks, particularly when using receiver-type inputs, to exfiltrate tokens for any ServiceAccount in the namespace. This enables the attacker to capture tokens via the output URL, inheriting the RBAC permissions of the targeted ServiceAccount and potentially achieving cluster-wide privilege escalation.
Affected products
- Red Hat Logging Subsystem for Red Hat OpenShift 6
Timeline
- 2026-06-02: other: Vulnerability reported to Red Hat Bugzilla
- 2026-06-23: disclosed: Public disclosure of CVE-2026-10609