MEDIUM 6.8 Go
OpenShift Cluster Logging Operator missing authorization flaw
GHSA-9xm2-gw56-wj7m · CVE-2026-10609
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-10609
- WEB https://github.com/openshift/cluster-logging-operator/pull/3383
- WEB https://github.com/openshift/cluster-logging-operator/commit/1864c2a9851da90a3956f1b83c5f31b3b76e3514
- WEB https://access.redhat.com/security/cve/CVE-2026-10609
- WEB https://bugzilla.redhat.com/show_bug.cgi?id=2483943
- PACKAGE https://github.com/openshift/cluster-logging-operator
Ready to move
Start Securing
Free, no credit card | First findings in minutes