All vulnerabilities
CVE-2026-10609GHSA-9xm2-gw56-wj7mGO-2026-6590

OpenShift Cluster Logging Operator missing authorization flaw

Red Hat github.com/openshift/cluster-logging-operatorgoOperating systems
Open in ThreatlineRecord JSON
CVSS
6.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 30% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.0.0-20260804174055-1864c2a9851dFixed versionGitHub
Published23 Jun 2026Updated 1 Oct 2026CVE List

What fixes it

  • 0.0.0-20260804174055-1864c2a9851dgithub.com/openshift/cluster-logging-operator, goGitHubgo get github.com/openshift/cluster-logging-operator@v0.0.0-20260804174055-1864c2a9851d
  • 0.0.0-20260804174055-1864c2a9851dgithub.com/openshift/cluster-logging-operator, GoOSVgo get github.com/openshift/cluster-logging-operator@v0.0.0-20260804174055-1864c2a9851d

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

Text from CVE List

Affected versions 2

  • github.com/openshift/cluster-logging-operator, go< 0.0.0-20260804174055-1864c2a9851dGitHub
  • github.com/openshift/cluster-logging-operator, Gofrom first release, fixed in 0.0.0-20260804174055-1864c2a9851dOSV

References 6