EUVD-2026-38448
GHSA-9xm2-gw56-wj7m
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
PR:H reflects mandatory editor-level RBAC access; S:C and C:H capture cross-namespace SA token exfiltration enabling privilege escalation.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.
AnalysisAI
Privilege escalation via ServiceAccount token exfiltration affects the OpenShift Cluster Logging Operator, allowing a user with delegated editor-level access to the ClusterLogForwarder resource to harvest SA tokens they were never authorized to use. The operator creates ServiceAccount tokens and forwards them to configured log output destinations without verifying whether the ClusterLogForwarder creator holds permission to consume those credentials. An attacker who has obtained an editor role within the logging namespace can weaponize this design gap to exfiltrate high-privilege SA tokens and escalate to broader cluster access. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Technical ContextAI
The OpenShift Cluster Logging Operator is a Kubernetes operator that manages the lifecycle of log collection and forwarding within Red Hat OpenShift clusters. Administrators and delegated users define log pipelines via ClusterLogForwarder custom resources, which instruct the operator where to route cluster logs. As part of this pipeline, the operator programmatically creates Kubernetes ServiceAccount tokens and embeds them as credentials for the configured output destination. The root cause (CWE-862: Missing Authorization) is the operator's failure to perform a permission check at the point of token creation: it does not validate whether the principal who submitted the ClusterLogForwarder manifest is actually authorized to use the targeted ServiceAccount's token. The affected CPE is cpe:2.3:a:red_hat:logging_subsystem_for_red_hat_openshift:*:*:*:*:*:*:*:*, indicating the flaw spans multiple versions of the logging subsystem.
RemediationAI
The primary remediation is to apply the patch released by Red Hat via the official advisory at https://access.redhat.com/security/cve/CVE-2026-10609; however, no specific fixed version number is confirmed in the available data - verify the exact patched release from the advisory before upgrading. Until a patch is applied, compensating controls should focus on restricting who can create or modify ClusterLogForwarder resources: audit and tighten RBAC policies to ensure only fully trusted administrators hold create/edit permissions on the ClusterLogForwarder CRD, removing delegated editor access from any principal that does not strictly require it. Additionally, audit existing ClusterLogForwarder configurations for any output destinations pointing to unexpected or external endpoints, which may indicate the flaw has already been exploited. Monitor ServiceAccount token usage through OpenShift audit logs for anomalous cross-namespace token consumption. Note that tightening RBAC on ClusterLogForwarder may break legitimate multi-tenant logging delegation workflows and should be tested before broad enforcement.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today