CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-10609	Mitigation Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2483943	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:cluster_logging_operator:-:::::::*
	cpe:2.3:a:redhat:logging_subsystem_for_red_hat_openshift:-:::::::*

History

08 Jul 2026, 15:10

Type	Values Removed	Values Added
CPE		cpe:2.3:a:redhat:cluster_logging_operator:-:::::::* cpe:2.3:a:redhat:logging_subsystem_for_red_hat_openshift:-:::::::*
References	~~() https://access.redhat.com/security/cve/CVE-2026-10609 -~~	() https://access.redhat.com/security/cve/CVE-2026-10609 - Mitigation, Vendor Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2483943 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2483943 - Issue Tracking, Vendor Advisory
First Time		Redhat cluster Logging Operator Redhat logging Subsystem For Red Hat Openshift Redhat

23 Jun 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-23 14:17

Updated : 2026-07-08 15:10

NVD link : CVE-2026-10609

Mitre link : CVE-2026-10609

CVE.ORG link : CVE-2026-10609

JSON object : View

Products Affected

redhat

logging_subsystem_for_red_hat_openshift
cluster_logging_operator

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-10609", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10609", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T13:58:23.388681Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:logging:6"], "vendor": "Red Hat", "product": "Logging Subsystem for Red Hat OpenShift", "packageName": "openshift-logging/cluster-logging-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-06-23T14:17:21.853", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-10609", "tags": ["Mitigation", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483943", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges."}], "lastModified": "2026-07-08T15:10:22.840", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:cluster_logging_operator:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A0B241E-0214-4C9D-B296-A84ED38C628A"}, {"criteria": "cpe:2.3:a:redhat:logging_subsystem_for_red_hat_openshift:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF93A27E-AA2B-4C2E-9B8D-FE7267847326"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}