CVE-2026-10609: OpenShift Privilege Escalation Vulnerability

CVE-2026-10609 Overview

CVE-2026-10609 is a missing authorization flaw [CWE-862] in the Red Hat OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations defined in a ClusterLogForwarder resource. It does not verify that the user creating the ClusterLogForwarder has permission to use the referenced ServiceAccount credentials. A delegated editor with rights to create or modify ClusterLogForwarder objects can redirect logs and exfiltrate ServiceAccount tokens. The attacker can then reuse those tokens to escalate privileges within the cluster.

Critical Impact
An authenticated namespace editor can exfiltrate ServiceAccount tokens through log forwarding and escalate privileges across the OpenShift cluster.

Affected Products

Red Hat OpenShift Cluster Logging Operator
Red Hat OpenShift Container Platform (deployments using the Logging Operator)
Workloads relying on ClusterLogForwarder for log shipping

Discovery Timeline

2026-06-23 - CVE-2026-10609 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in the NVD database

Technical Details for CVE-2026-10609

Vulnerability Analysis

The OpenShift Cluster Logging Operator reconciles ClusterLogForwarder custom resources and provisions output pipelines to destinations such as Elasticsearch, Loki, Kafka, or HTTP endpoints. When a pipeline references a ServiceAccount, the operator mints or mounts a token for that account and forwards it as part of the output configuration. The operator omits a SubjectAccessReview against the user submitting the ClusterLogForwarder. As a result, the operator acts on behalf of any principal with clusterlogforwarders edit rights, even when that principal cannot directly read the target ServiceAccount token.

Root Cause

The root cause is missing authorization enforcement [CWE-862] in the controller's admission and reconciliation path. The controller treats the ability to create or modify a ClusterLogForwarder as sufficient authority to delegate any ServiceAccount identity. Kubernetes Role-Based Access Control (RBAC) requires explicit use permissions on ServiceAccount references in similar workflows, but the operator does not perform that check.

Attack Vector

An attacker authenticated to the cluster with editor rights on ClusterLogForwarder resources crafts a forwarder that references a higher-privileged ServiceAccount, such as one bound to cluster-admin or a sensitive namespace. The attacker also configures an output destination they control, for example an external HTTP endpoint. When the operator reconciles the resource, it forwards log payloads authenticated with the targeted ServiceAccount token to the attacker-controlled endpoint. The attacker captures the token and reuses it to call the Kubernetes API directly. Refer to the Red Hat CVE Overview and Red Hat Bug Report #2483943 for vendor analysis.

Detection Methods for CVE-2026-10609

Indicators of Compromise

Newly created or modified ClusterLogForwarder resources referencing ServiceAccount objects in namespaces the submitting user does not own.
Outbound log traffic from cluster collector pods to unrecognized HTTP, syslog, or Kafka endpoints.
Kubernetes API requests using ServiceAccount tokens from source IPs outside the cluster network range.

Detection Strategies

Audit the Kubernetes API server logs for create and update verbs on clusterlogforwarders.logging.openshift.io and correlate the user identity with the referenced serviceAccountName.
Inspect collector pod configurations for output sinks pointing to non-approved destinations.
Compare the list of ServiceAccount tokens referenced by log forwarders against an allowlist maintained by the platform team.

Monitoring Recommendations

Alert on any ClusterLogForwarder change where the requesting user lacks get permission on the referenced ServiceAccount.
Monitor egress traffic from the openshift-logging namespace and baseline expected destinations.
Track TokenRequest and TokenReview events tied to logging-related ServiceAccount identities.

How to Mitigate CVE-2026-10609

Immediate Actions Required

Apply the Red Hat patched release of the Cluster Logging Operator as soon as it is available for your channel.
Restrict clusterlogforwarders create and update permissions to platform administrators using RBAC.
Audit existing ClusterLogForwarder resources and remove any referencing ServiceAccount objects outside the logging namespace.

Patch Information

Red Hat tracks remediation under the advisory linked from the Red Hat CVE Overview. Consult the Red Hat Bug Report #2483943 for fixed component versions and errata identifiers tied to your OpenShift release channel.

Workarounds

Remove edit rights on ClusterLogForwarder from delegated namespace administrators until the operator is patched.
Pin log forwarder output destinations using admission policies such as Kyverno or OPA Gatekeeper to block untrusted endpoints.
Rotate any ServiceAccount tokens that were referenced by untrusted forwarders and revoke active sessions tied to those tokens.

bash

# Configuration example: restrict ClusterLogForwarder edit rights to platform admins
oc adm policy remove-cluster-role-from-group \
  clusterlogforwarder-editor system:authenticated

# Review existing forwarders and their referenced ServiceAccounts
oc get clusterlogforwarders -A \
  -o jsonpath='{range .items[*]}{.metadata.namespace}{"/"}{.metadata.name}{" -> "}{.spec.serviceAccountName}{"\n"}{end}'