CVE-2026-10609: OpenShift Cluster Logging Operator Missing Authorization Vulnerability

Technical summary

CVE-2026-10609 is a missing authorization vulnerability (CWE-862) in Red Hat's OpenShift Cluster Logging Operator. The operator fails to enforce RBAC authorization checks before forwarding ServiceAccount tokens through ClusterLogForwarder objects to configured output destinations. An authenticated user with ClusterLogForwarder creation or edit permissions can exploit this to exfiltrate ServiceAccount tokens without the operator verifying the creator's eligibility to access those credentials. This enables privilege escalation within the cluster by leveraging the permissions embedded in the forwarded tokens.

Business impact

This vulnerability creates an insider risk and privilege escalation pathway in OpenShift environments. An operator or delegated cluster editor could move laterally or escalate privileges by obtaining ServiceAccount tokens for sensitive workloads. Affected organizations lose the assurance that credential access is properly gated by role-based access control, potentially exposing infrastructure, application data, or inter-service communication. The impact is magnified in multi-tenant or federated OpenShift clusters where delegation of administrative tasks is common.

Affected systems

Red Hat Cluster Logging Operator and Red Hat Logging Subsystem for Red Hat OpenShift are affected. The vulnerability applies to instances where ClusterLogForwarder objects are used to forward logs to external or internal destinations. Clusters relying on the operator for log aggregation and forwarding are in scope if they have users with delegated editor permissions on ClusterLogForwarder resources.

Exploitability

Exploitation requires network access to the OpenShift cluster API and valid credentials with permissions to create or modify ClusterLogForwarder objects—a moderate privilege level. No user interaction is required once the forwarder is configured. The CVSS vector (PR:H) reflects that the attacker must already hold a higher-privilege account, but the impact is substantial because it bypasses intended authorization boundaries. This is not a zero-click vulnerability, but it is straightforward to execute for a delegated administrator.

Remediation

Apply security patches from Red Hat as they become available. Verify patch availability and version guidance by consulting the Red Hat security advisories and product documentation for both Cluster Logging Operator and Logging Subsystem for Red Hat OpenShift. In the interim, restrict ClusterLogForwarder creation and edit permissions to only trusted administrators, and audit existing log forwarder configurations to ensure they are not exfiltrating credentials. Monitor ServiceAccount token usage for anomalies.

Patch guidance

Consult Red Hat's official security advisories for the Cluster Logging Operator and Logging Subsystem for Red Hat OpenShift to identify patched versions. Verify the specific version numbers and release dates in those advisories before planning your patch cycle. Test patches in a non-production OpenShift environment first, as logging operators are critical path components. Plan a maintenance window to avoid disruption to log collection and forwarding during the upgrade.

Detection guidance

Monitor ClusterLogForwarder resource creation and modifications using Kubernetes audit logs. Look for forwarders created by users with elevated edit permissions that forward logs to unusual or external destinations. Use RBAC analysis tools to identify which ServiceAccounts are being exposed through active forwarders. Correlate ServiceAccount token usage in access logs with ClusterLogForwarder configurations to detect unauthorized token exfiltration. Enable audit logging at the Kubernetes API level to capture ClusterLogForwarder spec changes.

Why prioritize this

Although the CVSS score is MEDIUM (6.8), the vulnerability enables privilege escalation and credential exfiltration in Kubernetes-based infrastructure. It bypasses fundamental authorization controls and affects all log-forwarding pipelines in the cluster. In environments where ClusterLogForwarder is widely delegated (common in large enterprises), the risk surface is broad. The lack of KEV status does not reduce operational priority—patch as part of your regular security patching cadence, prioritizing systems with delegated ClusterLogForwarder permissions and sensitive ServiceAccounts exposed to forwarding.

Risk score, explained

The CVSS 3.1 score of 6.8 (MEDIUM) reflects high confidentiality impact (C:H) because ServiceAccount tokens grant access to cluster resources, but no integrity or availability impact. The complexity is low (AC:L) because no special conditions are required to trigger the flaw. The attack requires high privileges (PR:H) to set up a forwarder, but the scope is changed (S:C) because the impact extends beyond the attacker's original authorization level. This scoring is appropriate for an insider threat that breaches intended access controls.

Frequently asked questions