CVE-2026-10609

MediumCVSS 6.8/10Last modified Nov 13, 2026

Description

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Red Hat	Logging Subsystem for Red Hat OpenShift 6.5	—

References

https://access.redhat.com/errata/RHSA-2026:99823
https://access.redhat.com/security/cve/CVE-2026-10609Mitigation, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2483943Issue Tracking, Vendor Advisory

Timeline

Published: Jun 23, 2026
Last modified: Nov 13, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-1060908.8ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curre CVE-2026-1060953.3The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives th CVE-2026-1060976.8The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in so CVE-2026-1060985.3The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifyin CVE-2026-1060995.3The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only wi CVE-2026-10619.8A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhj CVE-2026-106108.5Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user.CVE-2026-1061007.1Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions b CVE-2026-1061013.1Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils CVE-2026-10610210.0Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in CVE-2026-1061037.1Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie genera CVE-2026-1061048.7Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbound