CVE-2026-10609

medium Red Hat
CVSS v3 Base Score
6.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Confidentiality
High
Integrity
None
Availability
None
Published: June 23, 2026 (16 days ago)
Last Modified: June 23, 2026
Vendor: Red Hat
Source: REDHAT

Description

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

CWE

CWE-862

Affected Products

Logging Subsystem for Red Hat OpenShift

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov