GHSA-9xm2-gw56-wj7m

OpenShift Cluster Logging Operator missing authorization flaw

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-10609

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/openshift/cluster-logging-operator	< 0.0.0-20260804174055-1864c2a9851d	0.0.0-20260804174055-1864c2a9851d

Details

As written in the advisory (Markdown source, shown as plain text).

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-10609 advisory
https://github.com/openshift/cluster-logging-operator/pull/3383 web
https://github.com/openshift/cluster-logging-operator/commit/1864c2a9851da90a3956f1b83c5f31b3b76e3514 web
https://access.redhat.com/security/cve/CVE-2026-10609 web
https://bugzilla.redhat.com/show_bug.cgi?id=2483943 web
https://github.com/openshift/cluster-logging-operator package