Fluentd Configuration Injection in Logging Operator Enables Remote Code Execution

A high-severity flaw tracked as CVE-2026-54680 allows remote code execution in the kube-logging/logging-operator before version 6.6.0 by injecting malicious content into generated Fluentd configuration. The bug is in the FluentRender component, which writes CRD-supplied strings directly into fluent.conf without properly escaping special characters. Attackers with permission to create Flow or ClusterFlow resources can abuse fields such as record_transformer.records to break out of nested configuration blocks and insert arbitrary top-level Fluentd directives.

By injecting a crafted <match **> block and using plugins such as @type exec, an attacker can execute arbitrary commands inside the Fluentd aggregator when logs are processed. The vulnerability is classified as command injection and configuration injection, mapped to CWE-77 and CWE-74, with CVSS v3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Maintainers fixed the issue in logging-operator 6.6.0 by escaping newline, carriage return, tab, quote, backslash, and # characters, while defenders were also provided a Kyverno policy example to block newline characters in vulnerable record fields as a mitigation.