EUVD-2026-50419
GHSA-mjqf-28ph-426h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Reachable via the Kubernetes API (AV:N/AC:L), needs only namespace rights to create Flow CRs (PR:L), and code runs in the separate shared Fluentd aggregator, giving full RCE and a scope change (S:C, C/I/A:H).
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.
Articles & Coverage 2
AnalysisAI
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can create Flow/Output custom resources to break out of the generated fluent.conf and achieve remote code execution inside the shared Fluentd aggregator. Because the FluentRender renderer writes CRD values (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Logging operator is deployed with a Fluentd aggregator pipeline (not a Fluent Bit-only setup) and that the attacker holds Kubernetes RBAC permission to create Flow and Output custom resources (logging.banzaicloud.io/v1beta1) in a namespace watched by the operator, e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent and point to a genuine high priority in multi-tenant clusters. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A tenant with permission to manage logging in namespace tenant-a creates a nullout Output, then a Flow whose record_transformer.records value embeds newlines that close the `<record>`/`<filter>` blocks and open a `<match **>` block with `@type exec` and a `command` of the attacker's choice. When the operator renders and the aggregator reloads the config, the injected exec plugin runs arbitrary commands inside the shared Fluentd aggregator pod, giving the attacker code execution across the logging pipeline. … |
| Remediation | Vendor-released patch: upgrade the Logging operator to version 6.6.0 or later (release https://github.com/kube-logging/logging-operator/releases/tag/6.6.0), which introduces token validation and value escaping in FluentRender (commit cf437d7f1e056c78740bf5716ac8bdebcf002425). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all deployments of kube-logging Logging operator and document version numbers and associated namespace permissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Kamaji is the Hosted Control Plane Manager for Kubernetes. Rated critical severity (CVSS 9.9), this vulnerability is rem
Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, ref
String filter bypass in Inspektor Gadget Kubernetes eBPF tooling before fix. Insufficient string escaping enables filter
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today