A flaw in the fluent configuration renderer of the logging operator lets a user who can create Flow resources inject arbitrary <match > blocks into the generated fluent.conf file. By specifying a match block that uses @type exec, an attacker can execute arbitrary commands within the Fluentd aggregator, compromising the entire Kubernetes cluster. The weakness is an unsafely constructed external command string, classified under CWE-74 and CWE-77.

The kube-logging logging-operator, for all releases prior to 6.6.0, is affected. Any cluster running an older version than 6.6.0 without the vendor’s patch is vulnerable.

The CVSS score of 9.9 indicates a high severity of impact. The EPSS score of less than 1% suggests that exploitation likelihood is low at the time of reporting, and it is not yet listed in the CISA KEV catalog. However, because the vulnerability is remote code execution and the attacker must create a Flow custom resource, privileged users with that capability could abuse the flaw rapidly by injecting executable blocks into the Fluentd pipeline.