An authenticated command injection vulnerability in logging-operator allows attackers with Flow resource creation privileges to execute arbitrary commands in the logging pipeline.

This is a command injection vulnerability occurring because user-supplied CRD strings are written directly into fluent.conf without sanitization. An authenticated attacker can inject a malicious Fluentd match block to gain code execution.

Successful exploitation allows an attacker to escalate privileges from a standard user to the logging operator context, which typically runs with elevated permissions within the cluster. Given the 9.9 CVSS score, this represents a near-total compromise of the logging infrastructure, facilitating data exfiltration and potential cluster-wide disruption.

Immediate Action: Update the logging-operator to version 6.6.0 or the specified fixed build to ensure proper input sanitization.

Proactive Monitoring: Audit Kubernetes RBAC policies to restrict who can create or modify Flow resources and monitor for unusual process execution within logging pods.

Compensating Controls: Utilize Admission Controllers or OPA Gatekeeper to validate Flow resource definitions and prevent the injection of malicious configuration strings.

Public Exploit Available: No (exploit_available: false)

This vulnerability is critical due to the potential for full system compromise within the logging pipeline. Security teams should treat this as a high-priority update and restrict access to resource creation as a temporary mitigation measure.