Read the docs
TI-2026-40305 Aliases CVE-2026-55841GHSA-gqr6-r77p-c2pj

Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message

Priority MEDIUM 40CWE-138Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java mishandles field-like text inside quoted values. GLFortiGateSyslogEvent.getFields() uses KV_PATTERN and QUOTED_KV_PATTERN, while SyslogCodec.parse() invokes the FortiGateSyslogEvent parser; crafted values containing = or backslash-escaped quotes can cause embedded keys such as srcip, dstip, date, time, and tz to remove or overwrite original top-level fields or produce an invalid message that Graylog discards. An unauthenticated network sender who can submit syslog messages can therefore manipulate security-log fields or evade logging to obscure malicious activity. This issue is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00633 50th percentileScored 2026-11-07
Fix Fixed graylog2-server (Graylog2): 6.3.12, 7.0.7, 7.1.2org.graylog2:graylog2-server (Maven): 6.3.12, 7.0.7, 7.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Graylog2graylog2-serverbefore 6.3.12; 7.0.0-alpha.1 to before 7.0.7; 7.1.0-alpha.1 to before 7.1.26.3.12, 7.0.7, 7.1.2Patch availableCNA
—org.graylog2:graylog2-server (Maven)before 6.3.126.3.12Patch availableGHSA-gqr6-r77p-c2pj
—org.graylog2:graylog2-server (Maven)7.0.0 to before 7.0.77.0.7Patch availableGHSA-gqr6-r77p-c2pj
—org.graylog2:graylog2-server (Maven)7.1.0 to before 7.1.27.1.2Patch availableGHSA-gqr6-r77p-c2pj
  • graylog2-server VendorGraylog2 Affected before 6.3.12; 7.0.0-alpha.1 to before 7.0.7; 7.1.0-alpha.1 to before 7.1.2 Fixed in 6.3.12, 7.0.7, 7.1.2 Patch available CNA
  • org.graylog2:graylog2-server (Maven) Vendor— Affected before 6.3.12 Fixed in 6.3.12 Patch available GHSA-gqr6-r77p-c2pj
  • org.graylog2:graylog2-server (Maven) Vendor— Affected 7.0.0 to before 7.0.7 Fixed in 7.0.7 Patch available GHSA-gqr6-r77p-c2pj
  • org.graylog2:graylog2-server (Maven) Vendor— Affected 7.1.0 to before 7.1.2 Fixed in 7.1.2 Patch available GHSA-gqr6-r77p-c2pj

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:graylog:graylog:*:*:*:*:*:*:*:*——Graylog2
  • cpe:2.3:a:graylog:graylog:*:*:*:*:*:*:*:* Versions — — ·Graylog2

Remediation

  • Fix · CNA graylog2-server (Graylog2) Fixed in 6.3.12, 7.0.7, 7.1.2
  • Fix · GHSA-gqr6-r77p-c2pj org.graylog2:graylog2-server (Maven) Fixed in 6.3.12 Advisory →
  • Fix · GHSA-gqr6-r77p-c2pj org.graylog2:graylog2-server (Maven) Fixed in 7.0.7 Advisory →
  • Fix · GHSA-gqr6-r77p-c2pj org.graylog2:graylog2-server (Maven) Fixed in 7.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55841
  2. 2026-10-03 Alias added: GHSA-gqr6-r77p-c2pj
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Other 10

  • TI-2024-16341 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request CVSS 3.1HIGH 8.8
  • TI-2023-21671 Insecure source port usage for DNS queries in Graylog CVSS 3.1MEDIUM 5.3
  • TI-2026-01133 Incorrect management of session invalidation vulnerability in Graylog Web Interface CVSS 4.0CRITICAL 9.3
  • TI-2023-21667 User session is still usable after logout in graylog2-server CVSS 3.1LOW 3.1
  • TI-2021-15624 A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate… CVSS 3.1CRITICAL 9.8
  • TI-2021-15623 A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to… CVSS 3.1CRITICAL 9.8
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences