CVE-2026-39879
Received Received - Intake

SQL Injection in syslog-ng

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-39879
EUVD
EUVD-2026-46031

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
syslog-ng syslog-ng to 4.12 (exc)
syslog-ng syslog-ng_premium_edition 8.2
syslog-ng syslog-ng_store_box 7.8
syslog-ng syslog-ng_premium_edition to 8.2 (exc)
syslog-ng syslog-ng_store_box to 7.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-150 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in syslog-ng versions before 4.12 caused by missing sanitization in the afsql_dd_run_query function. It allows SQL injection from untrusted sources but requires manual SQL driver configuration as it is not part of the default setup.

Detection Guidance

Check syslog-ng version with 'syslog-ng --version' to confirm if it's below 4.12. Review SQL driver configurations for manual setups. Monitor logs for unusual SQL queries or errors indicating injection attempts.

Impact Analysis

An attacker could exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion in databases configured with the vulnerable syslog-ng SQL destination driver.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information, potentially resulting in compliance breaches.

Mitigation Strategies

Upgrade syslog-ng to version 4.12 or later. If using Premium Edition or Store Box, upgrade to 8.2 or 7.8 respectively. Disable SQL driver if not needed. Implement server-side query sanitization as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39879. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart