CVE-2026-54680
A flaw in the Logging Operator for Kubernetes allows attackers who can create Flow resources to inject malicious commands into the Fluentd aggregator, potentially giving them full control over the cluster. The issue is fixed in version 6.6.0.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running the Logging Operator for Kubernetes before version 6.6.0, especially those who can create Flow resources.
Real-world impact
An attacker could inject arbitrary commands into the Fluentd aggregator, leading to remote code execution and compromising the confidentiality, integrity, and availability of the Kubernetes cluster.
Why this severity
The CVSS score is high because the vulnerability is network accessible, requires low effort to exploit, and can change the scope of the system, giving an attacker full control over the cluster.
What to do about it
- 01Upgrade the Logging Operator to version 6.6.0 or later.
NVD-referenced vendor advisory
Timeline
- Jul 29, 2026 · 19h agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 17h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.