CVE-2026-10609

Katalog CVE

CVSS 6.8 · Medium EPSS 0,38%

Kerentanan Missing Authorization pada redhat cluster logging operator, redhat logging subsystem for red hat openshift. Skor CVSS 3.1 6.8 (Medium) menurut redhat.com.

Deskripsi (NVD)

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

8 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.8 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-10609 mitigasi · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2483943 issue tracking · advisory vendor