Cluster Logging Operator EUVD-2026-38448

Exploitation requires that the attacker hold a Kubernetes RBAC role granting create or update permissions on ClusterLogForwarder custom resources within the OpenShift cluster - this corresponds to a 'delegated editor' role as described in the CVE. The Cluster Logging Operator must be installed and active in the cluster. The flaw is triggered purely by submitting a crafted ClusterLogForwarder manifest; no additional cluster-side configuration is needed beyond the operator's default operation. What limits exploitation: the attacker must already have elevated (editor-level) access to the logging namespace, significantly restricting the attacker population. Unauthenticated or low-privilege users cannot exploit this vulnerability. The S:C scope change means impact extends beyond the logging namespace, but initial access is gated on existing RBAC delegation.

The CVSS 3.1 base score of 6.8 reflects a notable but constrained risk profile: PR:H indicates the attacker must already hold high privileges (delegated editor access to create ClusterLogForwarder resources), which meaningfully limits the attack surface. However, the S:C (scope changed) and C:H metrics signal that successful exploitation has outsized impact - exfiltrated SA tokens can be leveraged outside the logging namespace, potentially granting cluster-wide privilege escalation. This scope crossing is what elevates the real-world danger despite the high privilege prerequisite. There is no EPSS data available in the provided intelligence, no CISA KEV listing, and no confirmed public exploit code, all of which reduce urgency compared to a zero-interaction network-exploitable flaw. Organizations where RBAC delegation is loosely managed or where the logging operator is deployed in multi-tenant OpenShift clusters face the greatest real-world exposure. The primary risk is insider threat or account compromise at the editor level leading to lateral movement.

An attacker who has compromised or legitimately holds a delegated editor account within an OpenShift cluster creates a ClusterLogForwarder resource specifying an attacker-controlled HTTPS endpoint as the log output destination. The Cluster Logging Operator, without checking the creator's authorization, generates a ServiceAccount token scoped to a privileged SA and forwards it to the attacker's endpoint embedded in the request. The attacker extracts the SA token, presents it to the OpenShift API server, and operates with the privileges of the harvested ServiceAccount, potentially gaining cluster-admin or namespace-admin level access across the cluster.