Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in …

CVE-2026-54680 affects the Kubernetes Logging Operator prior to version 6.6.0. The vulnerability exists in the FluentRender configuration renderer located in pkg/sdk/logging/model/render/fluent.go, which writes CRD string values directly into fluent.conf without proper escaping. An attacker with the ability to create Flow resources can inject a malicious Fluentd block using @type exec, enabling arbitrary command execution inside the Fluentd aggregator container. This represents a significant privilege escalation and remote code execution risk within Kubernetes logging pipelines. The issue has been patched in version 6.6.0 of the logging-operator. Users are strongly advised to upgrade to the fixed version immediately.