CVE catalog

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogFo

[CVE catalog]

Severity
Medium · CVSS 6.8CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.38% · Oct 25, 2026

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cpecluster_logging_operatorNot reportedNot reportedunknown
Cpelogging_subsystem_for_red_hat_openshiftNot reportedNot reportedunknown
Gogithub.com/openshift/cluster-logging-operatorNot reported0.0.0-20260804174055-1864c2a9851dfixed
Cpecluster_logging_operatorNot reportedNot reportedunknown
Cpelogging_subsystem_for_red_hat_openshiftNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Gogithub.com/openshift/cluster-logging-operatorgoNot reported0.0.0-20260804174055-1864c2a9851dNot reportedGHSA-9XM2-GW56-WJ7MNot reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]