CVE-2026-10609

Published: Jun 23, 2026Modified: Jul 8, 2026

6.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Exploitability: 2.3 / Impact: 4.0

Source: secalert@redhat.com (Secondary)

Description

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

Affected (2)

Products: Redhat: Cluster Logging Operator, Logging Subsystem For Red Hat Openshift

2 products

Cluster Logging Operator

Logging Subsystem For Red Hat Openshift

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Cluster Logging Operator	All versions
Redhat Logging Subsystem For Red Hat Openshift	All versions

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://access.redhat.com/security/cve/CVE-2026-10609

Source: secalert@redhat.com

MitigationVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2483943

Source: secalert@redhat.com

Issue TrackingVendor Advisory

Timeline

No history available yet.