Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54680.
Unlock with Pro - from £29/user/moDetect Kube-logging Logging Operator Fluentd Configuration Injection RCE (CVE-2026-54680) in Microsoft Sentinel
Detects exploitation of CVE-2026-54680, a critical (CVSS 9.9) configuration injection vulnerability in kube-logging logging-operator (versions prior to the 0.0.0-20260608145523-cf437d7f1e05 pseudo-version / 6.6.0 release) that allows an attacker with the ability to influence Fluentd/Fluent Bit configuration inputs (e.g. via Flow/ClusterFlow/Output CRDs, log forwarding pipelines, or unsanitized log fields reflected into config templates) to inject arbitrary Fluentd configuration directives. This injection can lead to remote code execution via Fluentd's exec plugin, ruby code blocks, or file-based output writes, potentially compromising the logging-operator pod and any Kubernetes service account/token it holds, enabling lateral movement and cluster compromise.
MITRE ATT&CK
KQL Detection Query
let SuspiciousFluentdDirectives = dynamic(["exec", "exec_filter", "script", "ruby", "system(", "`", "| sh", "| bash", "/bin/sh", "/bin/bash"]);
KubernetesConfigLog
| where TimeGenerated > ago(24h)
| where PodName has_any ("logging-operator", "fluentd", "fluent-bit")
| where ObjectKind in ("Flow", "ClusterFlow", "Output", "ClusterOutput", "Logging")
| where OperationType in ("create", "update", "patch")
| extend ConfigContent = tostring(RequestObject)
| where ConfigContent has_any (SuspiciousFluentdDirectives)
| project TimeGenerated, PodName, Namespace, ObjectKind, UserAgent, RequestingUser=RequestObject.metadata.managedFields, ConfigContent
| union (
ContainerLogV2
| where TimeGenerated > ago(24h)
| where PodName has_any ("logging-operator", "fluentd", "fluent-bit")
| where LogMessage has_any (SuspiciousFluentdDirectives) or LogMessage has "invalid configuration" or LogMessage has "parse error"
| project TimeGenerated, PodName, Namespace, ConfigContent=LogMessage
)
| order by TimeGenerated descDetects Kubernetes audit log entries and container logs showing suspicious Fluentd directive injection (exec, script, ruby blocks, shell metacharacters) written to Flow/ClusterFlow/Output custom resources or observed in logging-operator/fluentd pod logs, indicative of CVE-2026-54680 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate use of exec/script output plugins by cluster admins for approved log processing pipelines
- Internal security tooling that intentionally references shell-like strings in log messages for testing
- Fluentd configuration validation errors unrelated to malicious injection
- Third-party log forwarders with legitimate ruby filter plugins in use
Other platforms for CVE-2026-54680
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Inject exec directive via ClusterFlow CRD
Expected signal: Kubernetes audit log entries for create operations on ClusterFlow and ClusterOutput resources containing an 'exec' block, followed by fluentd operator reconciliation logs regenerating the rendered configuration.
- Test 2Inject ruby eval block into Output configuration
Expected signal: Audit log capturing the Output resource creation with enableRuby=true and a system() call embedded in the record template; fluentd pod logs showing plugin reconfiguration.
- Test 3Simulate command execution artifact from compromised fluentd pod
Expected signal: Container runtime/EDR process execution events for /bin/sh, id, whoami, and cat commands executed inside the fluentd pod, plus Kubernetes audit log entry for the 'pods/exec' subresource.
References (4)
- https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h
- https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425
- https://github.com/kube-logging/logging-operator/releases/tag/6.6.0
- https://github.com/advisories/GHSA-mjqf-28ph-426h
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54680 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month