6.8
Medium
CVE-2026-10609 A missing authorization flaw was found in the OpenShift Cluster Logging Operator
Description
A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2483943 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Logging Subsystem for Red Hat OpenShift
The 78 CVEs of Logging Subsystem for Red Hat OpenShift →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Medium
CVE-2026-92925
Redis: redis: out-of-bounds read via crafted cluster bus packets
7.1
High
CVE-2026-16242
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes
9.4
Critical
CVE-2026-27145
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name…
6.5
Medium