{"id":"CVE-2026-54680","summary":"Logging operator has Fluentd configuration injection that allows remote code execution","details":"Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd \u003cmatch **\u003e block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.","aliases":["GHSA-mjqf-28ph-426h"],"modified":"2026-07-31T03:46:16.072249290Z","published":"2026-07-29T16:57:16.913Z","database_specific":{"cwe_ids":["CWE-74","CWE-77"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54680.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/kube-logging/logging-operator/releases/tag/6.6.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54680.json"},{"type":"ADVISORY","url":"https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54680"},{"type":"FIX","url":"https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kube-logging/logging-operator","events":[{"introduced":"0"},{"fixed":"cf437d7f1e056c78740bf5716ac8bdebcf002425"},{"fixed":"5f9688ed7db9cfc42ce2ddbd636bba1497065e24"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"6.6.0"}]}}],"versions":["6.5.2","6.5.1","6.5.0","6.4.0","6.3.2","6.3.1","6.3.0","6.2.2","6.2.1","6.2.0","6.1.0","6.0.3","6.0.2","6.0.1","6.0.0","5.4.0","pkg/sdk/v0.12.0","5.3.0","5.3.0-dev.0","5.2.0","5.1.1","5.1.0","5.1.0-dev.1","5.1.0-dev.0","5.0.1","5.0.0","4.11.2-dev.1","4.11.0","4.10.0-rc.0","4.10.0","4.9.1","4.9.0","4.8.0","4.7.0","4.7.0-rc.0","4.7.0-dev.0","4.6.0-dev.2","4.6.0-dev.1","4.6.0-dev.0","4.5.0","4.5.0-rc.1","4.5.0-rc.0","4.4.5-rc.0","4.5.0-dev.0","pkg/sdk/v0.11.0","4.4.0","4.4.0-rc.0","4.4.0-dev.2","4.4.0-dev.1","4.4.0-dev.0","pkg/sdk/v0.10.0","4.3.0","4.3.0-rc.1","4.3.0-rc.0","0.0.0-dev.1","chart/logging-operator/3.17.10","chart/logging-operator-logging/3.17.10","chart/logging-demo/3.17.10","4.1.0","pkg/sdk/v0.9.1","4.0.0","4.0.0-rc19","pkg/sdk/v0.8.15","4.0.0-rc17","pkg/sdk/v0.8.14","4.0.0-rc16","pkg/sdk/v0.8.13","4.0.0-rc15","pkg/sdk/v0.8.10","3.17.10","chart/logging-operator/3.17.9","chart/logging-operator-logging/3.17.9","chart/logging-demo/3.17.9","node-exporter-v0.2.0","3.17.9","pkg/sdk/v0.7.27","chart/logging-operator/3.17.8","chart/logging-operator-logging/3.17.8","chart/logging-demo/3.17.8","3.17.8","fluentd-v1.14.6-alpine-6","pkg/sdk/v0.7.26","chart/logging-operator/3.17.7","chart/logging-operator-logging/3.17.7","chart/logging-demo/3.17.7","3.17.7","fluentd-v1.14.6-alpine-5","pkg/sdk/v0.7.25","chart/logging-operator/3.17.6","chart/logging-operator-logging/3.17.6","chart/logging-demo/3.17.6","3.17.6","pkg/sdk/v0.7.24","pkg/sdk/v0.7.23","chart/logging-operator/3.17.5","chart/logging-operator-logging/3.17.5","chart/logging-demo/3.17.5","3.17.5","pkg/sdk/v0.7.22","chart/logging-operator/3.17.4","chart/logging-operator-logging/3.17.4","chart/logging-demo/3.17.4","3.17.4","pkg/sdk/v0.7.21","chart/logging-operator/3.17.3","chart/logging-operator-logging/3.17.3","chart/logging-demo/3.17.3","3.17.3","pkg/sdk/v0.7.20","chart/logging-operator/3.17.2","chart/logging-operator-logging/3.17.2","chart/logging-demo/3.17.2","3.17.2","fluentd-v1.14.4-alpine-4","fluentd-v1.14.4-alpine-3","pkg/sdk/v0.7.19","chart/logging-operator/3.17.1","chart/logging-operator-logging/3.17.1","chart/logging-demo/3.17.1","3.17.1","fluentd-v1.14.4-alpine-2","chart/logging-operator/3.17.0","chart/logging-operator-logging/3.17.0","chart/logging-demo/3.17.0","pkg/sdk/v0.7.18","3.17.0","pkg/sdk/v0.7.17","chart/logging-operator/3.16.0","chart/logging-operator-logging/3.16.0","chart/logging-demo/3.16.0","3.16.0","fluentd-v1.13.3-alpine-12","pkg/sdk/v0.7.16","chart/logging-operator/3.15.0","chart/logging-operator-logging/3.15.0","chart/logging-demo/3.15.0","3.15.0","fluentd-v1.13.3-alpine-10","pkg/sdk/v0.7.15","3.14.3","pkg/sdk/v0.7.14","fluentd-v1.13.3-alpine-9","pkg/sdk/v0.7.13","fluentd-v1.13.3-alpine-8","pkg/sdk/v0.7.12","pkg/sdk/v0.7.6","chart/logging-operator/3.13.0","chart/logging-operator-logging/3.13.0","chart/logging-demo/3.13.0","3.13.0","pkg/sdk/v0.7.11","chart/logging-operator/3.14.2","chart/logging-operator-logging/3.14.2","chart/logging-demo/3.14.2","3.14.2","fluentd-v1.13.3-alpine-3","pkg/sdk/v0.7.10","chart/logging-operator/3.14.1","chart/logging-operator-logging/3.14.1","chart/logging-demo/3.14.1","3.14.1","pkg/sdk/v0.7.9","chart/logging-operator/3.14.0","chart/logging-operator-logging/3.14.0","chart/logging-demo/3.14.0","3.14.0","pkg/sdk/v0.7.8","pkg/sdk/v0.7.7","3.13.1","fluentd-v1.13.1-alpine-3","fluentd-v1.12.4-alpine-4","pkg/sdk/v0.7.5","fluentd-v1.12.4-alpine-2","pkg/sdk/v0.7.4","chart/logging-operator/3.12.0","chart/logging-demo/3.12.0","3.12.0","fluentd-drain-watch-v0.0.1","fluentd-v1.11.5-alpine-24","fluentd-v1.11.5-alpine-23","pkg/sdk/v0.7.2","chart/logging-operator/3.10.0","pkg/sdk/v0.7.1","3.10.0","pkg/sdk/v0.7.0","pkg/sdk/v0.6.17","fluentd-v1.11.5-alpine-22","chart/logging-operator/3.9.5","chart/logging-operator-logging/3.9.5","chart/logging-demo/3.9.5","3.9.5","fluentd-v1.11.5-alpine-20","fluentd-v1.11.5-alpine-13","pkg/sdk/v0.6.16","chart/logging-operator/3.9.4","chart/logging-operator-logging/3.9.4","chart/logging-demo/3.9.4","3.9.4","3.9.2","chart/logging-operator/3.9.3","pkg/sdk/v0.6.15","chart/logging-operator/3.9.2","chart/logging-operator-logging/3.9.2","chart/logging-demo/3.9.1","3.9.1","chart/logging-operator-logging/3.9.1","chart/logging-operator/3.9.1","chart/logging-operator/3.9.0","chart/logging-operator-logging/3.9.0","chart/logging-demo/3.9.0","3.9.0","pkg/sdk/v0.6.14","pkg/sdk/v0.6.13","fluentd-v1.11.5-alpine-7","3.8.4","fluentd-v1.11.5-alpine-5","pkg/sdk/v0.6.7","chart/logging-operator/3.8.3","chart/logging-operator-logging/3.8.3","chart/logging-demo/3.8.3","3.8.3","chart/logging-operator/3.8.2","chart/logging-operator-logging/3.8.2","chart/logging-demo/3.8.2","3.8.2","pkg/sdk/v0.6.6","3.8.1","chart/logging-operator-logging/3.8.1","pkg/sdk/v0.6.5","chart/logging-operator/3.8.0","chart/logging-operator-logging/3.8.0","chart/logging-demo/3.8.0","3.8.0","pkg/sdk/v0.6.4","pkg/sdk/v0.6.3","chart/logging-operator/3.7.3","chart/logging-operator-logging/3.7.3","chart/logging-demo/3.7.3","pkg/sdk/v0.6.2","3.7.3","3.7.2","pkg/sdk/v0.6.1","chart/logging-operator/3.7.1","chart/logging-operator-logging/3.7.1","chart/logging-demo/3.7.1","3.7.1","pkg/sdk/v0.6.0","chart/logging-operator/3.7.0","pkg/sdk/v0.3.20","chart/logging-operator-logging/3.7.0","chart/logging-demo/3.7.0","3.7.0","fluentd-v1.11.4-alpine-1","pkg/sdk/v0.5.0","pkg/sdk/v0.4.0","chart/logging-operator/3.6.1","pkg/sdk/v0.3.19","chart/logging-operator/3.6.0","chart/logging-operator-logging/3.6.0","chart/logging-demo/3.6.0","3.6.0","pkg/sdk/v0.3.18","fluentd-v1.11.2-alpine-3","3.5.1","pkg/sdk/v0.3.17","chart/logging-operator/3.5.0","chart/logging-operator-logging/3.5.0","chart/logging-demo/3.5.0","3.5.0","fluentd-v1.11.1-alpine-1","fluentd-v1.10.4-alpine-3","chart/logging-operator/3.4.0","chart/logging-operator-logging/3.4.0","chart/logging-demo/3.4.0","3.4.0","fluentd-v1.10.4-alpine-2","chart/logging-operator/3.3.0","chart/logging-operator-logging/3.3.0","chart/logging-demo/3.3.0","3.3.0","fluentd-v1.10.4-alpine-1","fluentd-v1.10.4","pkg/sdk/v0.3.16","3.2.1","chart/logging-operator/3.2.2","chart/logging-operator/3.2.1","pkg/sdk/v0.3.15","chart/logging-operator/3.2.0","chart/logging-operator-logging/3.2.0","chart/logging-demo/3.2.0","3.2.0","chart/logging-operator/3.1.0","chart/logging-operator-logging/3.1.0","chart/logging-demo/3.1.0","fluentd-v1.10.3-alpine-2","fluentd-v1.10.3-alpine-1","pkg/sdk/v0.3.14","3.2.0-rc3","pkg/sdk/v0.3.13","3.2.0-rc2","fluentd-v1.9.2-alpine-10","3.2.0-rc1","pkg/sdk/v0.3.12","pkg/sdk/v0.3.11","3.1.0","fluentd-v1.9.2-alpine-9","pkg/sdk/v0.3.10","chart/logging-operator/3.0.5","chart/logging-operator-logging/2.7.6","chart/logging-demo/3.0.1","3.1.0-rc1","fluentd-v1.9.2-alpine-8","pkg/sdk/v0.3.1","3.0.1","pkg/sdk/v0.3.0","chart/logging-operator-logging/2.7.5","chart/logging-operator-logging/2.7.4","chart/logging-operator/3.0.3","chart/logging-operator/3.0.2","3.0.0","3.0.0-rc.3","fluentd-v1.9.2-alpine-7","chart/logging-operator/3.0.1","3.0.0-rc.2","chart/logging-operator/3.0.0","chart/logging-demo/3.0.0","3.0.0-rc.1","pkg/sdk/2.7.0","chart/logging-operator/2.7.0","chart/logging-operator-logging/2.7.0","chart/logging-demo/2.7.0","2.7.0","chart/logging-operator/2.7.2","chart/logging-demo/2.7.1","chart/logging-operator-logging/2.7.2","chart/logging-operator/2.7.1","fluentd-v1.7.4-alpine-12","chart/logging-operator/2.6.1","chart/logging-operator-logging/2.6.1","2.6.1","chart/logging-operator/2.6.0","chart/logging-operator-logging/2.6.0","chart/logging-demo/2.6.0","2.6.0","chart/logging-operator/2.5.1","chart/logging-demo/2.4.0","fluentd-v1.7.4-alpine-7","chart/nginx-logging-loki-demo/2.5.0","chart/nginx-logging-kafka-demo/2.5.0","chart/nginx-logging-es-demo/2.5.0","chart/nginx-logging-demo/2.5.0","chart/nginx-logging-cw-demo/2.5.0","chart/nging-logging-es-demo/2.5.0","chart/logging-operator/2.5.0","chart/logging-operator-logging/2.5.0","2.5.0","chart/nginx-logging-loki-demo/2.4.0","chart/nginx-logging-kafka-demo/2.4.0","chart/nginx-logging-es-demo/2.4.0","chart/nginx-logging-demo/2.4.0","chart/nginx-logging-cw-demo/2.4.0","chart/logging-operator/2.4.0","chart/logging-operator-logging/2.4.0","2.4.0","chart/logging-operator/2.3.1","chart/logging-operator/2.3.0","chart/nginx-logging-loki-demo/2.3.0","chart/nginx-logging-kafka-demo/2.3.0","chart/nginx-logging-es-demo/2.3.0","chart/nginx-logging-demo/2.3.0","chart/logging-operator-logging/2.3.0","2.3.0","chart/logging-operator/2.2.0","2.2.0","chart/logging-operator/2.1.1","2.1.1","chart/nginx-logging-loki-demo/2.0.1","chart/logging-operator-logging/2.1.0","chart/logging-operator-logging/2.0.1","charts/nginx-logging-es-demo/0.2.0","chart/nginx-logging-loki-demo/0.2.0","chart/logging-operator/2.1.0","2.1.0","chart/logging-operator-fluent/0.3.3","1.0.0","0.2.3","chart/nginx-logging-demo/0.1.2","chart/logging-operator/0.3.3","chart/logging-operator-fluent/0.1.5","0.2.2","chart/logging-operator/0.3.2","chart/logging-operator-fluent/0.1.4","0.2.1","chart/nginx-logging-es-demo/0.1.1","chart/nginx-logging-demo/0.1.1","chart/logging-operator/0.3.1","chart/logging-operator-fluent/0.1.3","0.2.0","0.1.9","0.1.8","0.1.7","0.1.6","0.1.5","0.1.2","0.1.1","0.1.0","0.0.5","0.0.4","0.0.3","0.0.2","0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54680.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}