CVE-2026-10609 OpenShift Cluster Logging Operator missing authorization flaw
A missing authorization check allows delegated editors to exfiltrate ServiceAccount tokens and escalate privileges in the OpenShift Cluster Logging Operator.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-10609?
CVE-2026-10609 is a medium-severity missing authorization vulnerability in Logging Subsystem for Red Hat OpenShift, published on 23 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.
Weakness: CWE-862
Which versions are affected by CVE-2026-10609?
3 open source packages ship an affected version, including github.com/openshift/cluster-logging-operator. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openshift/cluster-logging-operator Go | All versions | None |
github.com/openshift/cluster-logging-operator Go | All versions | 0.0.0-20260804174055-1864c2a9851d |
github.com/openshift/cluster-logging-operator Go | All versions | 0.0.0-20260804174055-1864c2a9851d |
Products include Redhat Cluster Logging Operator, Redhat Logging Subsystem for Red Hat Openshift.
How do I fix CVE-2026-10609?
Upgrade github.com/openshift/cluster-logging-operator to 0.0.0-20260804174055-1864c2a9851d or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-10609 being exploited?
There is no known exploitation of CVE-2026-10609 in the wild and no public exploit code.
Sources
Also known as GHSA-9xm2-gw56-wj7m, GO-2026-6590.