CVE-2026-10609CWE-862

Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization

Medium · published June 23, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
30.2
In the wild
Unconfirmed
What it is

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00375 · 30.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-06-23T13:26Z
EPSS history
Timeline
  • 23 JUN 13:26Z
    Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization
    cvelistv5