Logging operator has Fluentd configuration injection that allows remote code execution
The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path, a value in record_transformer.records can close the current <record> / <filter> block and add a new <match **> block. By specifying Fluentd's core @type exec plugin …