MEDIUM6.8
GHSA-9xm2-gw56-wj7m
OpenShift Cluster Logging Operator missing authorization flaw
Quick fix
GHSA-9xm2-gw56-wj7m — github.com/openshift/cluster-logging-operator: upgrade to the fixed version with the command below.
go get github.com/openshift/cluster-logging-operator@v0.0.0-20260804174055-1864c2a9851dDetails
A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/openshift/cluster-logging-operator
Introduced in:
0Fixed in: 0.0.0-20260804174055-1864c2a9851dFix
go get github.com/openshift/cluster-logging-operator@v0.0.0-20260804174055-1864c2a9851dReferences
- https://nvd.nist.gov/vuln/detail/CVE-2026-10609[ADVISORY]
- https://github.com/openshift/cluster-logging-operator/pull/3383[WEB]
- https://github.com/openshift/cluster-logging-operator/commit/1864c2a9851da90a3956f1b83c5f31b3b76e3514[WEB]
- https://access.redhat.com/security/cve/CVE-2026-10609[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2483943[WEB]
- https://github.com/openshift/cluster-logging-operator[PACKAGE]