CVE-2026-55841 in Graylog
Summary
by MITRE • 08/29/2026
Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java mishandles field-like text inside quoted values. GLFortiGateSyslogEvent.getFields() uses KV_PATTERN and QUOTED_KV_PATTERN, while SyslogCodec.parse() invokes the FortiGateSyslogEvent parser; crafted values containing = or backslash-escaped quotes can cause embedded keys such as srcip, dstip, date, time, and tz to remove or overwrite original top-level fields or produce an invalid message that Graylog discards. An unauthenticated network sender who can submit syslog messages can therefore manipulate security-log fields or evade logging to obscure malicious activity. This issue is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/29/2026
Graylog serves as a widely deployed open-source log management platform designed to aggregate, index, and analyze machine-generated data from diverse sources including network devices, servers, and applications. A critical vulnerability exists within the parsing logic responsible for handling syslog messages formatted according to Fortinet FortiGate conventions. Specifically, this flaw resides in the GLFortiGateSyslogEvent class and the SyslogCodec component of the graylog2-server module. The issue affects Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2, as well as Graylog Forwarder version 7.3. This vulnerability stems from an improper handling of field-like text embedded within quoted values during the parsing process, allowing attackers to manipulate how log fields are interpreted by the system.
The technical root cause lies in the regular expression patterns used to extract key-value pairs from syslog messages. The GLFortiGateSyslogEvent.getFields() method utilizes KV_PATTERN and QUOTED_KV_PATTERN to parse incoming data, while SyslogCodec.parse() delegates this task to the FortiGateSyslogEvent parser. When a crafted syslog message contains values with equals signs or backslash-escaped quotes, the parsing logic fails to correctly distinguish between literal content within quoted strings and structural delimiters that define new fields. This misinterpretation allows an attacker to inject malicious key-value pairs into the parsed output. For instance, by carefully constructing input containing specific escape sequences, a sender can cause embedded keys such as srcip, dstip, date, time, or tz to overwrite existing top-level fields in the log entry. Alternatively, if the injection disrupts the structural integrity of the message beyond recovery, Graylog may discard the entire event as invalid, resulting in data loss rather than manipulation.
The operational impact of this vulnerability is significant for organizations relying on Graylog for security monitoring and incident response. An unauthenticated network sender who has access to send syslog messages can exploit this flaw to manipulate critical security-log fields. By overwriting source or destination IP addresses, an attacker could obscure the origin of malicious traffic, making it difficult for security analysts to trace attacks back to their true source. Furthermore, by causing log entries to be discarded entirely through malformed input, attackers can achieve a form of logging evasion. This capability allows adversaries to hide their activities from detection systems that rely on these specific FortiGate-formatted logs, thereby degrading the overall visibility and integrity of the security information management infrastructure.
This vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to adequately sanitize or validate input data before processing it into structured fields. It also relates to CWE-798 Use of Hard-coded Credentials if interpreted broadly in terms of trust boundaries, but more accurately fits CWE-1345 Incorrect Parsing Logic which leads to unexpected behavior. From an offensive security perspective, this technique is consistent with ATT&CK tactic T1070 Indicator Removal on Host or Local System, specifically sub-techniques involving log manipulation such as Log Injection (T1070.002) and Clear Linux Logs (T1070.004). The ability to overwrite fields represents a sophisticated form of log injection that can bypass simple signature-based detection rules designed for standard syslog formats.
To mitigate this risk, organizations running affected versions must upgrade Graylog Server to version 6.3.12 or later, specifically targeting releases 7.0.7 and 7.1.2 which also contain the fix. Similarly, users of Graylog Forwarder should update to version 7.3 or higher. These updates include corrected parsing logic that properly handles escaped characters within quoted values, ensuring that field boundaries are respected even when complex string content is present. Until upgrades can be performed, administrators should consider implementing network-level controls such as firewall rules to restrict which hosts are permitted to send syslog messages directly to Graylog instances. Additionally, deploying a log forwarder or SIEM component upstream of Graylog with stricter input validation policies can provide an additional layer of defense against malformed inputs attempting to exploit this parsing flaw.