https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T02:03:37.588465+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-54680 CVE-2026-54680 — Logging operator has Fluentd configuration injection that allows remote code execution 2026-10-08T02:03:37.605385+00:00

Affected: kube-logging logging-operator

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.