CVE-2026-10609 — Cluster Logging Operator
MEDIUMCVE-2026-10609 is a medium-severity (CVSS 6.8) CWE-862 vulnerability in redhat cluster logging operator. No vendor fix is recorded yet; mitigation options are listed below.
A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that…
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-10609.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-10609 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 394,415 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Description
A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.
Affected Products
cluster logging operatorredhatlogging subsystem for red hat openshiftredhatDetection & mitigation playbook
Vendor / applianceDetect
Inventory every redhat cluster logging operator deployment and check each version against the affected-products list above.
Remediation status
No patch has shipped for CVE-2026-10609 yet — track the redhat cluster logging operator advisory for a fixed release and apply the workarounds below in the meantime.
Mitigate without a patch
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
In a typical OpenShift Logging deployment a user managing ClusterLogForwarder objects is also expected to manage secrets with storage credentials. A user with the rights to manage secrets can obtain a token for a SA in the namespace and as such the flaw does not result in any privilege gain or security boundary being…
Restrict ClusterLogForwarder write access to trusted administrators only. Review existing ClusterRoleBindings and RoleBindings that grant clusterlogforwarders write permission. Apply NetworkPolicy egress restrictions to the collector namespace to prevent collector pods from reaching arbitrary external endpoints. Deploy admission controller policies (OPA/Gatekeeper/Kyverno) to deny CLF resources whose outputs point to non-allowlisted URLs. Monitor for ClusterLogForwarder resources with outputs pointing to external URLs, especially those using token.from: serviceAccount.Source: Red Hat security advisory for CVE-2026-10609 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2026-10609 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.