CVE-2026-55841
Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java mishandles field-like text inside quoted values. GLFortiGateSyslogEvent.getFields() uses KV_PATTERN and QUOTED_KV_PATTERN, while SyslogCodec.parse() invokes the FortiGateSyslogEvent parser; crafted values containing = or backslash-escaped quotes can cause embedded keys such as srcip, dstip, date, time, and tz to remove or overwrite original top-level fields or produce an invalid message that Graylog discards. An unauthenticated network sender who can submit syslog messages can therefore manipulate security-log fields or evade logging to obscure malicious activity. This issue is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVDNVD · Deferred | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.63% · top 49% of all CVEs (5 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
- affected < 6.3.12
- affected >= 7.0.0-alpha.1, < 7.0.7
- affected >= 7.1.0-alpha.1, < 7.1.2
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.graylog2:graylog2-serverGHSA-gqr6-r77p-c2pj (opens in a new tab)
References (9)
- https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-gqr6-r77p-c2pj (opens in a new tab)x_refsource_CONFIRM
- https://github.com/Graylog2/graylog2-server/pull/26050 (opens in a new tab)x_refsource_MISC
- https://github.com/Graylog2/graylog2-server/pull/26056 (opens in a new tab)x_refsource_MISC
- https://github.com/Graylog2/graylog2-server/pull/26057 (opens in a new tab)x_refsource_MISC
- https://github.com/Graylog2/graylog2-server/pull/26059 (opens in a new tab)x_refsource_MISC
- https://github.com/Graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f (opens in a new tab)x_refsource_MISC
- https://github.com/Graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627 (opens in a new tab)x_refsource_MISC
- https://github.com/Graylog2/graylog2-server/commit/d5051e604c962ef3d4e5e8e434d0ff4907d2140d (opens in a new tab)x_refsource_MISC
- https://github.com/Graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-gqr6-r77p-c2pj (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-55841)Record last updated .