CVE-2026-54680: kube-logging logging-operator command injection in Fluentd configuration renderer

Executive brief

The Logging operator, a tool used to manage log collection in Kubernetes environments, contains a vulnerability that allows users with permission to create logging configurations to execute unauthorized commands. By injecting malicious code into log processing rules, an attacker can gain control over the central log aggregator. This could lead to the theft of sensitive data, disruption of logging services, or further attacks against the underlying cloud infrastructure.

Technical details

A configuration injection vulnerability exists in the Fluentd configuration renderer of the Logging operator, specifically within the `FluentRender` function in `pkg/sdk/logging/model/render/fluent.go`. The operator writes strings from CRDs like `Flow` directly into `fluent.conf` without proper escaping or validation of newlines and special characters. An attacker with permissions to create `Flow` or `Output` resources can provide values containing newlines to close existing configuration blocks and inject a new `<match **>` block using the `@type exec` plugin. This enables arbitrary command execution within the Fluentd aggregator pod. The vulnerability is patched in version 6.6.0 and later.

Affected products

• kube-logging Logging operator < 0.0.0-20260608145523-cf437d7f1e05

Timeline

• 2026-06-08: patched: Fix committed to repository
• 2026-07-29: advisory: GitHub Advisory published

References

• https://api.github.com/users/hnts
• https://github.com/hnts
• https://api.github.com/users/hnts/gists%7B/gist_id%7D
• https://api.github.com/users/hnts/repos
• https://avatars.githubusercontent.com/u/60535109?v=4
• https://api.github.com/users/hnts/events%7B/privacy%7D