CVE-2026-54680: Kubernetes Logging Operator RCE Flaw

CVE-2026-54680 Overview

CVE-2026-54680 is a command injection vulnerability in the Kubernetes Logging operator maintained by the kube-logging project. The Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes Custom Resource Definition (CRD) string values directly into fluent.conf without escaping. A user who can create Flow resources can inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator pod. The issue is fixed in version 6.6.0 and is tracked under [CWE-74] Improper Neutralization of Special Elements in Output.

Critical Impact
An authenticated tenant with permission to create Flow resources can achieve arbitrary command execution inside the Fluentd aggregator, enabling lateral movement across the Kubernetes logging pipeline.

Affected Products

Kubernetes Logging operator (kube-logging/logging-operator) versions prior to 6.6.0
Fluentd aggregator deployments managed by the Logging operator
Multi-tenant Kubernetes clusters exposing Flow and ClusterFlow CRDs to namespace users

Discovery Timeline

2026-07-29 - CVE-2026-54680 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-54680

Vulnerability Analysis

The Logging operator automates deployment and configuration of Fluentd and Fluent Bit pipelines in Kubernetes. Users define log routing through Flow and ClusterFlow CRDs, which contain filter and record definitions. The operator renders these definitions into a Fluentd configuration file (fluent.conf) consumed by the aggregator.

The renderer in pkg/sdk/logging/model/render/fluent.go concatenates CRD-supplied strings, including record_transformer.records values, directly into structural configuration tokens. Because Fluentd directives such as <match>, @type, @id, and @label cannot be quoted, embedding a newline character inside a CRD value breaks out of the intended directive scope. An attacker can append an entirely new <match **> block that uses @type exec to invoke shell commands whenever matching log records flow through the aggregator.

Root Cause

The root cause is missing input validation and escaping when serializing CRD fields into Fluentd configuration syntax. Structural directive names, type identifiers, tags, and labels were emitted verbatim through f.indentedf without newline or metacharacter checks, permitting configuration injection [CWE-74].

Attack Vector

Exploitation requires low privileges (PR:L) — namely, permission to create Flow or ClusterFlow resources in a namespace whose logs are collected by the Fluentd aggregator. The attacker crafts a Flow with a filter value containing embedded newlines and a rogue <match **> block. When the operator reconciles the CRD and renders fluent.conf, the aggregator loads the attacker's directive and executes shell commands supplied to @type exec.

 		if meta.Directive == "" {
 			return fmt.Errorf("directive must have a name %s", meta)
 		}
+		// Structural tokens can't be quoted, so a newline would break out.
+		for _, t := range []struct{ kind, value string }{
+			{"directive name", meta.Directive},
+			{"@type", meta.Type},
+			{"@id", meta.Id},
+			{"@label", meta.Label},
+			{"@log_level", meta.LogLevel},
+			{"tag", meta.Tag},
+		} {
+			if err := validateFluentToken(t.kind, t.value); err != nil {
+				return err
+			}
+		}
 		f.indentedf(indent, "<%s%s>", meta.Directive, tag(meta.Tag))
 		if meta.Type != "" {
 			f.indentedf(indent+f.Indent, "@type %s", meta.Type)

Source: GitHub commit cf437d7 — the patch introduces validateFluentToken to reject newlines and other characters in structural tokens.

Detection Methods for CVE-2026-54680

Indicators of Compromise

Fluentd aggregator pods spawning unexpected child processes such as sh, bash, curl, wget, or nc.
fluent.conf contents inside aggregator pods containing @type exec directives that were not declared by cluster administrators.
Flow or ClusterFlow CRD objects whose string fields include literal \n characters or embedded <match>, <filter>, or @type tokens.
Outbound network connections from Fluentd aggregator pods to unexpected destinations.

Detection Strategies

Inspect the rendered fluent.conf inside aggregator pods and diff against a known-good baseline generated by the operator.
Audit Kubernetes API server logs for create and update events on flows.logging.banzaicloud.io and clusterflows.logging.banzaicloud.io originating from non-administrative service accounts.
Apply admission policies (OPA/Gatekeeper or Kyverno) that reject Flow CRDs whose string fields contain newline or <, > control characters.
Monitor container runtime telemetry for process executions inside Fluentd containers that deviate from the fluentd Ruby process tree.

Monitoring Recommendations

Enable Kubernetes audit logging for the logging.banzaicloud.io API group and forward events to a centralized analytics platform.
Track child-process creation events on Fluentd pods and alert on any non-Ruby executables spawned by fluentd.
Correlate CRD change events with subsequent process or network anomalies on aggregator pods within a short time window.

How to Mitigate CVE-2026-54680

Immediate Actions Required

Upgrade the Logging operator to version 6.6.0 or later, which introduces validateFluentToken and rejects unsafe CRD input.
Review all existing Flow and ClusterFlow resources for embedded newlines or unauthorized @type exec directives before upgrading.
Restrict RBAC permissions on the logging.banzaicloud.io API group so that only trusted operators can create or modify Flow resources.
Rotate any credentials, service account tokens, or secrets accessible to the Fluentd aggregator pod if compromise is suspected.

Patch Information

The fix is available in Logging operator release 6.6.0. Details are documented in GitHub Security Advisory GHSA-mjqf-28ph-426h and the corresponding remediation commit. The patch validates all structural Fluentd tokens — directive name, @type, @id, @label, @log_level, and tag — before rendering them into fluent.conf.

Workarounds

Deploy an admission controller policy that rejects Flow and ClusterFlow CRDs containing newline characters (\n, \r) or Fluentd directive delimiters (<, >).
Limit tenant namespaces to ClusterOutput references only and centralize Flow authoring under a platform team account.
Isolate Fluentd aggregator pods with NetworkPolicies and a restricted PodSecurity profile that forbids process execution beyond the fluentd runtime.

bash

# Upgrade the Logging operator Helm release to the patched version
helm repo update kube-logging
helm upgrade logging-operator kube-logging/logging-operator \
  --namespace logging \
  --version 6.6.0

# Verify the running image tag on the operator pod
kubectl -n logging get deploy logging-operator \
  -o jsonpath='{.spec.template.spec.containers[0].image}'

# Audit existing Flow resources for injection attempts
kubectl get flows.logging.banzaicloud.io -A -o yaml | \
  grep -E '@type exec|<match|\\n'