GHSA-9xm2-gw56-wj7m

OpenShift Cluster Logging Operator missing authorization flaw

En bref

Publiée: 2026-06-23 15:32 UTC
Mise à jour: 2026-10-01 20:56 UTC
CVE: CVE-2026-10609
Alias: GO-2026-6590
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Description

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

Paquets affectés

Paquet	Versions
Go · github.com/openshift/cluster-logging-operator	introduced 0, fixed 0.0.0-20260804174055-1864c2a9851d

Références

https://nvd.nist.gov/vuln/detail/CVE-2026-10609 ADVISORY
https://github.com/openshift/cluster-logging-operator/pull/3383 WEB
https://github.com/openshift/cluster-logging-operator/commit/1864c2a9851da90a3956f1b83c5f31b3b76e3514 WEB
https://access.redhat.com/security/cve/CVE-2026-10609 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2483943 WEB
https://github.com/openshift/cluster-logging-operator PACKAGE

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database