CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-10609	Mitigation Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2483943	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:cluster_logging_operator:-:::::::*
	cpe:2.3:a:redhat:logging_subsystem_for_red_hat_openshift:-:::::::*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Se encontró un defecto de autorización faltante en el OpenShift Cluster Logging Operator. El operador crea y reenvía tokens de ServiceAccount a destinos de salida sin verificar que el creador de ClusterLogForwarder tenga permiso para usar esas credenciales, permitiendo a un editor delegado exfiltrar tokens de SA y escalar privilegios.

Information

Published : 2026-06-23 14:17

Updated : 2026-10-25 23:10

NVD link : CVE-2026-10609

Mitre link : CVE-2026-10609

CVE.ORG link : CVE-2026-10609

JSON object : View

Products Affected

redhat

logging_subsystem_for_red_hat_openshift
cluster_logging_operator

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-10609", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10609", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T13:58:23.388681Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:logging:6"], "vendor": "Red Hat", "product": "Logging Subsystem for Red Hat OpenShift", "packageName": "openshift-logging/cluster-logging-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-06-23T14:17:21.853", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-10609", "tags": ["Mitigation", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483943", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges."}, {"lang": "es", "value": "Se encontr\u00f3 un defecto de autorizaci\u00f3n faltante en el OpenShift Cluster Logging Operator. El operador crea y reenv\u00eda tokens de ServiceAccount a destinos de salida sin verificar que el creador de ClusterLogForwarder tenga permiso para usar esas credenciales, permitiendo a un editor delegado exfiltrar tokens de SA y escalar privilegios."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:cluster_logging_operator:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A0B241E-0214-4C9D-B296-A84ED38C628A"}, {"criteria": "cpe:2.3:a:redhat:logging_subsystem_for_red_hat_openshift:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF93A27E-AA2B-4C2E-9B8D-FE7267847326"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}