CVE-2026-10609

Name of the Vulnerable Software and Affected Versions OpenShift Cluster Logging Operator (affected versions not specified)

Description A missing authorization flaw exists in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying if the creator of the ClusterLogForwarder has the necessary permissions to use those credentials. This allows a delegated editor to exfiltrate ServiceAccount tokens and escalate privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.