GitHub Advisoryadvisory · Go
GHSA-9xm2-gw56-wj7m OpenShift Cluster Logging Operator missing authorization flaw
MEDIUM
Official page ↗
- Aliases
- CVE-2026-10609
- Ecosystem
- Go
- Packages
- github.com/openshift/cluster-logging-operator
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
- Weaknesses
- CWE-862
- Reviewed
- 2026-09-24
Affected packages
• Go github.com/openshift/cluster-logging-operator: < 0.0.0-20260804174055-1864c2a9851d → fixed in 0.0.0-20260804174055-1864c2a9851d
Description
A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.
Related
Alias · CVE (1)
- CVE-2026-10609 A missing authorization flaw was found in the OpenShift Cluster Logging Operator. vulnerability
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-10609 advisory
- https://github.com/openshift/cluster-logging-operator/pull/3383 web
- https://github.com/openshift/cluster-logging-operator/commit/1864c2a9851da90a3956f1b83c5f31b3b76e3514 web
- https://access.redhat.com/security/cve/CVE-2026-10609 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2483943 web
- https://github.com/openshift/cluster-logging-operator package