https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T16:49:34.134446+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-342647 EUVD-2026-342647 2026-10-07T16:49:34.168313+00:00 EUVD-2026-342647 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54680 fkie_cve-2026-54680 2026-10-07T16:49:34.168350+00:00

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.

 https://cve.radiocsirt.org/vuln/ghsa-mjqf-28ph-426h GHSA-mjqf-28ph-426h — Logging operator has Fluentd configuration injection that allows remote code execution 2026-10-07T16:49:34.168384+00:00

Affected: Go: github.com/kube-logging/logging-operator

### Summary

The Fluentd configuration renderer in Logging operator writes strings from CRDs such as `Flow` directly into `fluent.conf` without escaping them. As a result, a user who can create `Flow` resources can inject Fluentd configuration by providing values that contain newlines.

In the confirmed path, a value in `record_transformer.records` can close the current `<record>` / `<filter>` block and add a new `<match **>` block. By specifying Fluentd's core `@type exec` plugin in that injected block, an attacker can execute arbitrary commands inside the Fluentd aggregator.

### Details

The issue is in `FluentRender` in `pkg/sdk/logging/model/render/fluent.go`.

https://github.com/kube-logging/logging-operator/blob/98275d2984aa8d731c4c975b8006aa433fc7bafa/pkg/sdk/logging/model/render/fluent.go#L60-L87

Each parameter is rendered as `key value`, but values are not quoted, and newlines or characters such as `<` and `>` are not rejected. In addition, `indentedf` builds the string with `fmt.Sprintf` and then splits it on `\n`, so newlines inside CRD values become new lines in the generated Fluentd configuration.

One input source is `record_transformer.records`. `ToDirective` passes `Record` (`map[string]string`) into `Params` without validation or escaping.

https://github.com/kube-logging/logging-operator/blob/98275d2984aa8d731c4c975b8006aa433fc7bafa/pkg/sdk/logging/model/filter/record_transformer.go#L92-L103

The config check in `pkg/resources/fluentd/appconfigmap.go` run…