Read the docs
TI-2026-04433 Aliases CVE-2026-5078GHSA-4vj7-5mj6-jm8m

morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

Priority LOW 30CWE-117Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 1 fixed, 9 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00332 26th percentileScored 2026-11-07
Fix Partial morgan (morgan): 1.11.0morgan (npm): 1.11.0Red Hat: 1 advisoryRed Hat: 1 fixed, 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
morganmorgan1.2.0 – 1.10.11.11.0Patch availableCNA
—morgan (npm)1.2.0 to before 1.11.01.11.0Patch availableGHSA-4vj7-5mj6-jm8m
  • morgan Vendormorgan Affected 1.2.0 – 1.10.1 Fixed in 1.11.0 Patch available CNA
  • morgan (npm) Vendor— Affected 1.2.0 to before 1.11.0 Fixed in 1.11.0 Patch available GHSA-4vj7-5mj6-jm8m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:morgan_project:morgan:*:*:*:*:*:node.js:*:*1.2.0 to before 1.11.0VulnerableMorgan Project
  • cpe:2.3:a:morgan_project:morgan:*:*:*:*:*:node.js:*:* Versions 1.2.0 to before 1.11.0 Vulnerable ·Morgan Project

Remediation

  • Fix · CNA morgan (morgan) Fixed in 1.11.0
  • Fix · GHSA-4vj7-5mj6-jm8m morgan (npm) Fixed in 1.11.0 Advisory →

Red Hat 1 advisory

  • RHSA-2026:38236 Released 2026-07-11 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images nodejs24-1:24.18.0-0.3.hum1@aarch64, nodejs24-1:24.18.0-0.3.hum1@src, nodejs24-1:24.18.0-0.3.hum1@x86_64 +16

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Confidential Compute AttestationAffectedNo fix yet: Fix deferred
Cryostat 4AffectedNo fix yet: Fix deferred
Red Hat Developer Hub 1AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesAffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet: Fix deferred
Self-service automation portal 2AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:38236
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5078
  2. 2026-10-03 Alias added: GHSA-4vj7-5mj6-jm8m
  3. 2026-10-27 Affected versions changed · Red Hat

References

Advisory 3

Other 1

  • TI-2026-59956 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences