Vulnerability-Lookup

CVE-2026-55841 (GCVE-0-2026-55841)

Vulnerability from cvelistv5 – Published: 2026-08-28 22:11 – Updated: 2026-09-01 02:03

Title

Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message

Summary

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java mishandles field-like text inside quoted values. GLFortiGateSyslogEvent.getFields() uses KV_PATTERN and QUOTED_KV_PATTERN, while SyslogCodec.parse() invokes the FortiGateSyslogEvent parser; crafted values containing = or backslash-escaped quotes can cause embedded keys such as srcip, dstip, date, time, and tz to remove or overwrite original top-level fields or produce an invalid message that Graylog discards. An unauthenticated network sender who can submit syslog messages can therefore manipulate security-log fields or evade logging to obscure malicious activity. This issue is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 02:02 UTC

CWE

CWE-138 - Improper Neutralization of Special Elements

Assigner

GitHub_M mitre root

References

9 references

URL	Tags
https://github.com/Graylog2/graylog2-server/secur…	x_refsource_CONFIRM
https://github.com/Graylog2/graylog2-server/pull/26050	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/pull/26056	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/pull/26057	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/pull/26059	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/commi…	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/commi…	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/commi…	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/commi…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Graylog2	graylog2-server	Affected: < 6.3.12 Affected: >= 7.0.0-alpha.1, < 7.0.7 Affected: >= 7.1.0-alpha.1, < 7.1.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55841",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T02:02:52.990384Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T02:03:04.137Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "graylog2-server",
          "vendor": "Graylog2",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.3.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0-alpha.1, \u003c 7.0.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.1.0-alpha.1, \u003c 7.1.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java mishandles field-like text inside quoted values. GLFortiGateSyslogEvent.getFields() uses KV_PATTERN and QUOTED_KV_PATTERN, while SyslogCodec.parse() invokes the FortiGateSyslogEvent parser; crafted values containing = or backslash-escaped quotes can cause embedded keys such as srcip, dstip, date, time, and tz to remove or overwrite original top-level fields or produce an invalid message that Graylog discards. An unauthenticated network sender who can submit syslog messages can therefore manipulate security-log fields or evade logging to obscure malicious activity. This issue is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-138",
              "description": "CWE-138: Improper Neutralization of Special Elements",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T22:11:08.747Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-gqr6-r77p-c2pj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-gqr6-r77p-c2pj"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/pull/26050",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/pull/26050"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/pull/26056",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/pull/26056"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/pull/26057",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/pull/26057"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/pull/26059",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/pull/26059"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/commit/d5051e604c962ef3d4e5e8e434d0ff4907d2140d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/commit/d5051e604c962ef3d4e5e8e434d0ff4907d2140d"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d"
        }
      ],
      "source": {
        "advisory": "GHSA-gqr6-r77p-c2pj",
        "discovery": "UNKNOWN"
      },
      "title": "Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55841",
    "datePublished": "2026-08-28T22:11:08.747Z",
    "dateReserved": "2026-06-17T16:29:38.865Z",
    "dateUpdated": "2026-09-01T02:03:04.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55841",
      "date": "2026-09-28",
      "epss": "0.00633",
      "percentile": "0.48278"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "graylog2-server",
                "vendor": "Graylog2",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 6.3.12"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 7.0.0-alpha.1, \u003c 7.0.7"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 7.1.0-alpha.1, \u003c 7.1.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java mishandles field-like text inside quoted values. GLFortiGateSyslogEvent.getFields() uses KV_PATTERN and QUOTED_KV_PATTERN, while SyslogCodec.parse() invokes the FortiGateSyslogEvent parser; crafted values containing = or backslash-escaped quotes can cause embedded keys such as srcip, dstip, date, time, and tz to remove or overwrite original top-level fields or produce an invalid message that Graylog discards. An unauthenticated network sender who can submit syslog messages can therefore manipulate security-log fields or evade logging to obscure malicious activity. This issue is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3."
          }
        ],
        "id": "CVE-2026-55841",
        "lastModified": "2026-09-09T21:09:13.080",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-55841",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T02:02:52.990384Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-28T23:17:07.840",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Graylog2/graylog2-server/commit/d5051e604c962ef3d4e5e8e434d0ff4907d2140d"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Graylog2/graylog2-server/pull/26050"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Graylog2/graylog2-server/pull/26056"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Graylog2/graylog2-server/pull/26057"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Graylog2/graylog2-server/pull/26059"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-gqr6-r77p-c2pj"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-138"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55841",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-01T02:02:52.990384Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-01T02:02:58.453Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "graylog2-server",
              "vendor": "Graylog2",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 6.3.12"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 7.0.0-alpha.1, \u003c 7.0.7"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 7.1.0-alpha.1, \u003c 7.1.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java mishandles field-like text inside quoted values. GLFortiGateSyslogEvent.getFields() uses KV_PATTERN and QUOTED_KV_PATTERN, while SyslogCodec.parse() invokes the FortiGateSyslogEvent parser; crafted values containing = or backslash-escaped quotes can cause embedded keys such as srcip, dstip, date, time, and tz to remove or overwrite original top-level fields or produce an invalid message that Graylog discards. An unauthenticated network sender who can submit syslog messages can therefore manipulate security-log fields or evade logging to obscure malicious activity. This issue is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-138",
                  "description": "CWE-138: Improper Neutralization of Special Elements",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-28T22:11:08.747Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-gqr6-r77p-c2pj",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-gqr6-r77p-c2pj"
            },
            {
              "name": "https://github.com/Graylog2/graylog2-server/pull/26050",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Graylog2/graylog2-server/pull/26050"
            },
            {
              "name": "https://github.com/Graylog2/graylog2-server/pull/26056",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Graylog2/graylog2-server/pull/26056"
            },
            {
              "name": "https://github.com/Graylog2/graylog2-server/pull/26057",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Graylog2/graylog2-server/pull/26057"
            },
            {
              "name": "https://github.com/Graylog2/graylog2-server/pull/26059",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Graylog2/graylog2-server/pull/26059"
            },
            {
              "name": "https://github.com/Graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f"
            },
            {
              "name": "https://github.com/Graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627"
            },
            {
              "name": "https://github.com/Graylog2/graylog2-server/commit/d5051e604c962ef3d4e5e8e434d0ff4907d2140d",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Graylog2/graylog2-server/commit/d5051e604c962ef3d4e5e8e434d0ff4907d2140d"
            },
            {
              "name": "https://github.com/Graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d"
            }
          ],
          "source": {
            "advisory": "GHSA-gqr6-r77p-c2pj",
            "discovery": "UNKNOWN"
          },
          "title": "Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-55841",
        "datePublished": "2026-08-28T22:11:08.747Z",
        "dateReserved": "2026-06-17T16:29:38.865Z",
        "dateUpdated": "2026-09-01T02:03:04.137Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55841

Vulnerability from fkie_nvd - Published: 2026-08-28 23:17 - Updated: 2026-09-09 21:09

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/commit/d5051e604c962ef3d4e5e8e434d0ff4907d2140d
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/pull/26050
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/pull/26056
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/pull/26057
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/pull/26059
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-gqr6-r77p-c2pj

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "graylog2-server",
          "vendor": "Graylog2",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.3.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0-alpha.1, \u003c 7.0.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.1.0-alpha.1, \u003c 7.1.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java mishandles field-like text inside quoted values. GLFortiGateSyslogEvent.getFields() uses KV_PATTERN and QUOTED_KV_PATTERN, while SyslogCodec.parse() invokes the FortiGateSyslogEvent parser; crafted values containing = or backslash-escaped quotes can cause embedded keys such as srcip, dstip, date, time, and tz to remove or overwrite original top-level fields or produce an invalid message that Graylog discards. An unauthenticated network sender who can submit syslog messages can therefore manipulate security-log fields or evade logging to obscure malicious activity. This issue is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3."
    }
  ],
  "id": "CVE-2026-55841",
  "lastModified": "2026-09-09T21:09:13.080",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55841",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-01T02:02:52.990384Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-28T23:17:07.840",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/commit/d5051e604c962ef3d4e5e8e434d0ff4907d2140d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26050"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26056"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26057"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26059"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-gqr6-r77p-c2pj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-138"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GQR6-R77P-C2PJ

Vulnerability from github – Published: 2026-08-28 22:13 – Updated: 2026-08-28 22:13

Summary

Fortigate syslog message parser can be exploited to modify or delete fields from the original message

Details

Impact

A security issue has been identified in Graylog affecting the parsing of syslog messages that use a key-value format, such as those generated by Fortigate devices.

The vulnerability allows attackers to overwrite individual message fields, or to produce invalid messages which Graylog will discard. This effectively enables log evasion techniques to obscure malicious activity.

Patches

The issue has been fixed in the following Graylog versions: 6.3.12, 7.0.7, 7.1.2. Users should upgrade to one of these versions or above to remediate the vulnerability.

Graylog Cloud has already been patched.

Workarounds

There are no feasible workarounds for this issue. Upgrading to a patched version is recommended.

To find potentially discarded messages due to parsing errors, customers of Graylog Enterprise or Security can check the Indexing and Processing Failures Index^1.

Credits

Thanks to Jose Luis González, from Fundación Sarenet, with additional analysis by Borja Marcos from Sarenet.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.graylog2:graylog2-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.3.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.graylog2:graylog2-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.graylog2:graylog2-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.1.0"
            },
            {
              "fixed": "7.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55841"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-138"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T22:13:00Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nA security issue has been identified in Graylog affecting the parsing of syslog messages that use a key-value format, such as those generated by Fortigate devices.\n\nThe vulnerability allows attackers to overwrite individual message fields, or to produce invalid messages which Graylog will discard. This effectively enables log evasion techniques to obscure malicious activity.\n\n### Patches\n\nThe issue has been fixed in the following Graylog versions: `6.3.12`, `7.0.7`, `7.1.2`. Users should upgrade to one of these versions or above to remediate the vulnerability.\n\nGraylog Cloud has already been patched.\n\n### Workarounds\n\nThere are no feasible workarounds for this issue. Upgrading to a patched version is recommended.\n\nTo find potentially discarded messages due to parsing errors, customers of Graylog Enterprise or Security can check the Indexing and Processing Failures Index[^1]. \n\n### Credits\n\nThanks to Jose Luis Gonz\u00e1lez, from Fundaci\u00f3n Sarenet, with additional analysis by Borja Marcos from Sarenet. \n\n\n[^1]: https://go2docs.graylog.org/current/getting_in_log_data/indexer_and_processing_failures.html",
  "id": "GHSA-gqr6-r77p-c2pj",
  "modified": "2026-08-28T22:13:00Z",
  "published": "2026-08-28T22:13:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-gqr6-r77p-c2pj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26050"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26056"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26057"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26059"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/commit/d5051e604c962ef3d4e5e8e434d0ff4907d2140d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Graylog2/graylog2-server"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Fortigate syslog message parser can be exploited to modify or delete fields from the original message"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55841 (GCVE-0-2026-55841)

FKIE_CVE-2026-55841

GHSA-GQR6-R77P-C2PJ

Impact

Patches

Workarounds

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour