Kube-logging Logging Operator Fluentd Configuration Injection RCE (CVE-2026-54680)

let SuspiciousFluentdDirectives = dynamic(["exec", "exec_filter", "script", "ruby", "system(", "`", "| sh", "| bash", "/bin/sh", "/bin/bash"]);
KubernetesConfigLog
| where TimeGenerated > ago(24h)
| where PodName has_any ("logging-operator", "fluentd", "fluent-bit")
| where ObjectKind in ("Flow", "ClusterFlow", "Output", "ClusterOutput", "Logging")
| where OperationType in ("create", "update", "patch")
| extend ConfigContent = tostring(RequestObject)
| where ConfigContent has_any (SuspiciousFluentdDirectives)
| project TimeGenerated, PodName, Namespace, ObjectKind, UserAgent, RequestingUser=RequestObject.metadata.managedFields, ConfigContent
| union (
ContainerLogV2
| where TimeGenerated > ago(24h)
| where PodName has_any ("logging-operator", "fluentd", "fluent-bit")
| where LogMessage has_any (SuspiciousFluentdDirectives) or LogMessage has "invalid configuration" or LogMessage has "parse error"
| project TimeGenerated, PodName, Namespace, ConfigContent=LogMessage
)
| order by TimeGenerated desc

index=kubernetes sourcetype IN ("kube:audit", "fluentd:log", "fluent-bit:log")
(kind="Flow" OR kind="ClusterFlow" OR kind="Output" OR kind="ClusterOutput" OR kind="Logging")
(verb="create" OR verb="update" OR verb="patch")
| eval config_content=coalesce(requestObject, _raw)
| regex config_content="(?i)(exec_filter|<exec>|<script>|ruby\s+do|system\(|`.*`|\|\s*(sh|bash)\b|/bin/(sh|bash))"
| rex field=objectRef.namespace "(?<namespace>.*)"
| table _time, sourcetype, namespace, objectRef.name, kind, verb, user.username, config_content
| append [
 search index=kubernetes sourcetype="fluentd:log" (pod_name="*logging-operator*" OR pod_name="*fluentd*" OR pod_name="*fluent-bit*")
 ("invalid configuration" OR "parse error" OR "unexpected token" OR "exec_filter" OR "ruby eval")
 | table _time, sourcetype, pod_name, namespace, _raw
 ]
| sort -_time

sequence by k8s.namespace with maxspan=10m
 [any where event.dataset == "kubernetes.audit_logs" and
   kubernetes.audit.objectRef.resource in ("flows", "clusterflows", "outputs", "clusteroutputs", "loggings") and
   kubernetes.audit.verb in ("create", "update", "patch") and
   kubernetes.audit.requestObject.raw : ("*exec*", "*ruby*", "*system(*", "*/bin/sh*", "*/bin/bash*")]
 [any where event.dataset in ("kubernetes.container_logs") and
   (process.name in ("fluentd", "fluent-bit") or container.name : "*logging-operator*") and
   (message : "*invalid configuration*" or message : "*parse error*" or message : "*exec_filter*")]

SELECT DATEFORMAT(devicetime, 'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, "Namespace", "Resource Kind", "Verb", "Request Object"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Kubernetes%'
AND ("Resource Kind" IN ('Flow','ClusterFlow','Output','ClusterOutput','Logging'))
AND ("Verb" IN ('create','update','patch'))
AND ("Request Object" ILIKE '%exec%' OR "Request Object" ILIKE '%ruby%' OR "Request Object" ILIKE '%system(%' OR "Request Object" ILIKE '%/bin/sh%' OR "Request Object" ILIKE '%/bin/bash%')
LAST 24 HOURS

_sourceCategory=kubernetes/audit OR _sourceCategory=kubernetes/fluentd
| where objectRef_resource matches "flows" or objectRef_resource matches "clusterflows" or objectRef_resource matches "outputs" or objectRef_resource matches "clusteroutputs" or objectRef_resource matches "loggings"
| where verb matches "create" or verb matches "update" or verb matches "patch"
| parse regex "(?<config_content>requestObject.{0,2000})"
| where config_content matches "*exec*" or config_content matches "*ruby*" or config_content matches "*system(*" or config_content matches "*/bin/sh*" or config_content matches "*/bin/bash*"
| count by objectRef_namespace, objectRef_name, verb, user_username
| sort by _count

rule cve_2026_54680_fluentd_config_injection {
  meta:
    author = "df00tech"
    description = "Detects Fluentd configuration injection via logging-operator CRDs consistent with CVE-2026-54680"
    severity = "critical"
    cve = "CVE-2026-54680"

  events:
    $audit.metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
    $audit.target.resource.resource_subtype = /(?i)(flow|clusterflow|output|clusteroutput|logging)/
    $audit.metadata.product_event_type = /(?i)(create|update|patch)/
    $audit.target.resource.attribute.labels.raw_config = /(?i)(exec_filter|<exec>|<script>|ruby\s+do|system\(|\/bin\/(sh|bash))/

  match:
    $audit over 10m

  outcome:
    $risk_score = 95
    $mitre_technique_id = "T1210"

  condition:
    $audit
}

#event_simpleName=K8SAuditEvent
| in(field=objectRef.resource, values=["flows","clusterflows","outputs","clusteroutputs","loggings"])
| in(field=verb, values=["create","update","patch"])
| regex(field=requestObject_raw, pattern="(?i)(exec_filter|<exec>|<script>|ruby\s+do|system\(|/bin/(sh|bash))")
| table([@timestamp, objectRef.namespace, objectRef.name, verb, user.username, requestObject_raw])
| sort(@timestamp, order=desc)