GHSA-9xm2-gw56-wj7m

OpenShift Cluster Logging Operator missing authorization flaw

At a glance

Published: 2026-06-23 15:32 UTC
Updated: 2026-10-01 20:56 UTC
CVE: CVE-2026-10609
Aliases: GO-2026-6590
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Description

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

Affected packages

Package	Versions
Go · github.com/openshift/cluster-logging-operator	introduced 0, fixed 0.0.0-20260804174055-1864c2a9851d

References

https://nvd.nist.gov/vuln/detail/CVE-2026-10609 ADVISORY
https://github.com/openshift/cluster-logging-operator/pull/3383 WEB
https://github.com/openshift/cluster-logging-operator/commit/1864c2a9851da90a3956f1b83c5f31b3b76e3514 WEB
https://access.redhat.com/security/cve/CVE-2026-10609 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2483943 WEB
https://github.com/openshift/cluster-logging-operator PACKAGE

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database