CVE-2026-55841

Received Received - Intake

FortiGate Syslog Field Manipulation in Graylog

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java mishandles field-like text inside quoted values. GLFortiGateSyslogEvent.getFields() uses KV_PATTERN and QUOTED_KV_PATTERN, while SyslogCodec.parse() invokes the FortiGateSyslogEvent parser; crafted values containing = or backslash-escaped quotes can cause embedded keys such as srcip, dstip, date, time, and tz to remove or overwrite original top-level fields or produce an invalid message that Graylog discards. An unauthenticated network sender who can submit syslog messages can therefore manipulate security-log fields or evade logging to obscure malicious activity. This issue is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55841

Affected Vendors & Products

Vendor	Product	Version / Range
graylog	graylog_server	to 7.1.2 (inc)
graylog	graylog_forwarder	7.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-138	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects Graylog, a log management platform. It involves a flaw in the FortiGate syslog parser where crafted syslog messages with specific characters like = or backslash-escaped quotes can manipulate or overwrite security-log fields such as srcip, dstip, date, time, and tz. This allows unauthenticated attackers to alter log data or evade logging entirely.

Detection Guidance

Detecting this vulnerability requires checking the Graylog server and forwarder versions. Use commands like 'graylog-server --version' or check package managers (e.g., 'rpm -qa | grep graylog-server' or 'dpkg -l | grep graylog-server'). Ensure versions are 6.3.12, 7.0.7, 7.1.2, or higher for Graylog Server and 7.3 or higher for Graylog Forwarder.

Impact Analysis

An attacker could exploit this to manipulate log entries, removing or changing critical security information. This could obscure malicious activity, making it harder to detect breaches or investigate incidents. Systems relying on accurate logs for monitoring or compliance could be misled.

Compliance Impact

This vulnerability could compromise compliance by allowing tampering with audit logs. GDPR requires accurate logging for data protection, while HIPAA mandates secure and reliable logging for healthcare data. Manipulated logs may fail audits or legal requirements.

Mitigation Strategies

Upgrade Graylog Server to versions 6.3.12, 7.0.7, or 7.1.2, and Graylog Forwarder to version 7.3 or later. If upgrading is not immediately possible, restrict syslog message sources to trusted networks or systems to reduce exposure.

Hi! I’m here to help you understand CVE-2026-55841. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70