CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution
Attackers with Flow creation permissions can inject Fluentd configuration to execute arbitrary commands in the aggregator.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54680?
CVE-2026-54680 is a critical code injection vulnerability in kube-logging logging-operator, published on 29 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.
Which versions are affected by CVE-2026-54680?
3 open source packages ship an affected version, including github.com/kube-logging/logging-operator.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kube-logging/logging-operator Go | All versions | 0.0.0-20260608145523-cf437d7f1e05 |
github.com/kube-logging/logging-operator Go | All versions | 0.0.0-20260608145523-cf437d7f1e05 |
github.com/kube-logging/logging-operator Go | All versions | 0.0.0-20260608145523-cf437d7f1e05 |
How do I fix CVE-2026-54680?
Upgrade github.com/kube-logging/logging-operator to 0.0.0-20260608145523-cf437d7f1e05 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-54680 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54680 exists.
Sources
Also known as GHSA-mjqf-28ph-426h, GO-2026-6142, MINI-c369-jg4r-mpwx, MINI-rfpc-v9g6-8qhw.