CVE-2026-54680: Logging operator has Fluentd configuration injection that allows remote code execution

The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines.

In the confirmed path, a value in record_transformer.records can close the current <record> / <filter> block and add a new <match **> block. By specifying Fluentd’s core @type exec plugin in that injected block, an attacker can execute arbitrary commands inside the Fluentd aggregator.