Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/kube-logging/logging-operator | go | < 0.0.0-20260608145523-cf437d7f1e05 | 0.0.0-20260608145523-cf437d7f1e05 |
Miggo AIRoot Cause AnalysisThe vulnerability is a classic injection flaw where user-controllable data from a Kubernetes CRD (Flow) is used to generate a configuration file (fluent.conf) without proper escaping. The root cause is in the pkg/sdk/logging/model/render/fluent.go file.
The function render.FluentRender.RenderDirectives iterates through key-value pairs that originate from the user-defined Flow resource. Before the patch, it passed these values directly to the indentedf helper function. The indentedf function would then split any multi-line string values by the newline character. This allowed an attacker to craft a CRD with a specially formatted multi-line string that would close the current configuration block and inject a new, malicious one, such as a <match> block with @type exec to achieve remote code execution.
The patch addresses this by introducing two new functions: validateFluentToken and escapeFluentValue. In RenderDirectives, validateFluentToken is now used to ensure that configuration keys do not contain newlines, and escapeFluentValue is used to quote and escape any values that contain newlines. This ensures that user-provided values are treated as single string literals within the Fluentd configuration and cannot be used to inject new directives.
render.FluentRender.RenderDirectivespkg/sdk/logging/model/render/fluent.go
render.FluentRender.indentedfpkg/sdk/logging/model/render/fluent.go