6.8
Moyenne
CVE-2026-10609 A missing authorization flaw was found in the OpenShift Cluster Logging Operator
Description
A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Versions non publiées |
Références
- access.redhat.com access.redhat.com
- RHBZ#2483943 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Logging Subsystem for Red Hat OpenShift
Les 78 CVE de Logging Subsystem for Red Hat OpenShift →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Moyenne
CVE-2026-92925
Redis: redis: out-of-bounds read via crafted cluster bus packets
7.1
Élevée
CVE-2026-16242
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes
9.4
Critique
CVE-2026-27145
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name…
6.5
Moyenne