https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 19:33:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-342647 EUVD-2026-342647 https://cve.radiocsirt.org/vuln/euvd-2026-342647 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54680 <p>Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd &lt;match **&gt; block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.</p> <p>Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd &lt;match **&gt; block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54680 https://cve.radiocsirt.org/vuln/ghsa-mjqf-28ph-426h <p><strong>Affected:</strong> Go: github.com/kube-logging/logging-operator</p> <p>### Summary</p> <p>The Fluentd configuration renderer in Logging operator writes strings from CRDs such as `Flow` directly into `fluent.conf` without escaping them. As a result, a user who can create `Flow` resources can inject Fluentd configuration by providing values that contain newlines.</p> <p>In the confirmed path, a value in `record_transformer.records` can close the current `&lt;record&gt;` / `&lt;filter&gt;` block and add a new `&lt;match **&gt;` block. By specifying Fluentd&#39;s core `@type exec` plugin in that injected block, an attacker can execute arbitrary commands inside the Fluentd aggregator.</p> <p>### Details</p> <p>The issue is in `FluentRender` in `pkg/sdk/logging/model/render/fluent.go`.</p> <p>https://github.com/kube-logging/logging-operator/blob/98275d2984aa8d731c4c975b8006aa433fc7bafa/pkg/sdk/logging/model/render/fluent.go#L60-L87</p> <p>Each parameter is rendered as `key value`, but values are not quoted, and newlines or characters such as `&lt;` and `&gt;` are not rejected. In addition, `indentedf` builds the string with `fmt.Sprintf` and then splits it on `\n`, so newlines inside CRD values become new lines in the generated Fluentd configuration.</p> <p>One input source is `record_transformer.records`. `ToDirective` passes `Record` (`map[string]string`) into `Params` without validation or escaping.</p> <p>https://github.com/kube-logging/logging-operator/blob/98275d2984aa8d731c4c975b8006aa433fc7bafa/pkg/sdk/logging/model/filter/record_transformer.go#L92-L103</p> <p>The config check in `pkg/resources/fluentd/appconfigmap.go` run…</p> <p><strong>Affected:</strong> Go: github.com/kube-logging/logging-operator</p> <p>### Summary</p> <p>The Fluentd configuration renderer in Logging operator writes strings from CRDs such as `Flow` directly into `fluent.conf` without escaping them. As a result, a user who can create `Flow` resources can inject Fluentd configuration by providing values that contain newlines.</p> <p>In the confirmed path, a value in `record_transformer.records` can close the current `&lt;record&gt;` / `&lt;filter&gt;` block and add a new `&lt;match **&gt;` block. By specifying Fluentd&#39;s core `@type exec` plugin in that injected block, an attacker can execute arbitrary commands inside the Fluentd aggregator.</p> <p>### Details</p> <p>The issue is in `FluentRender` in `pkg/sdk/logging/model/render/fluent.go`.</p> <p>https://github.com/kube-logging/logging-operator/blob/98275d2984aa8d731c4c975b8006aa433fc7bafa/pkg/sdk/logging/model/render/fluent.go#L60-L87</p> <p>Each parameter is rendered as `key value`, but values are not quoted, and newlines or characters such as `&lt;` and `&gt;` are not rejected. In addition, `indentedf` builds the string with `fmt.Sprintf` and then splits it on `\n`, so newlines inside CRD values become new lines in the generated Fluentd configuration.</p> <p>One input source is `record_transformer.records`. `ToDirective` passes `Record` (`map[string]string`) into `Params` without validation or escaping.</p> <p>https://github.com/kube-logging/logging-operator/blob/98275d2984aa8d731c4c975b8006aa433fc7bafa/pkg/sdk/logging/model/filter/record_transformer.go#L92-L103</p> <p>The config check in `pkg/resources/fluentd/appconfigmap.go` run…</p> https://cve.radiocsirt.org/vuln/ghsa-mjqf-28ph-426h