{"id":"CVE-2026-55841","title":"Graylog is a free and open log management platform","summary":"Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/c…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-138"],"vendor":"graylog2","product":"org.graylog2:graylog2-server","affected":["org.graylog2:graylog2-server < 6.3.12","org.graylog2:graylog2-server >= 7.0.0, < 7.0.7","org.graylog2:graylog2-server >= 7.1.0, < 7.1.2"],"patched":["org.graylog2:graylog2-server 6.3.12","org.graylog2:graylog2-server 7.0.7","org.graylog2:graylog2-server 7.1.2"],"published":"2026-08-28","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55841","references":[{"url":"https://github.com/Graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f","label":"security-advisories@github.com"},{"url":"https://github.com/Graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627","label":"security-advisories@github.com"},{"url":"https://github.com/Graylog2/graylog2-server/commit/d5051e604c962ef3d4e5e8e434d0ff4907d2140d","label":"security-advisories@github.com"},{"url":"https://github.com/Graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d","label":"security-advisories@github.com"},{"url":"https://github.com/Graylog2/graylog2-server/pull/26050","label":"security-advisories@github.com"},{"url":"https://github.com/Graylog2/graylog2-server/pull/26056","label":"security-advisories@github.com"},{"url":"https://github.com/Graylog2/graylog2-server/pull/26057","label":"security-advisories@github.com"},{"url":"https://github.com/Graylog2/graylog2-server/pull/26059","label":"security-advisories@github.com"},{"url":"https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-gqr6-r77p-c2pj","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-gqr6-r77p-c2pj"}],"tags":["nvd","ghsa","maven"],"epss":0.00355,"epssPercentile":0.29197,"aliases":["GHSA-gqr6-r77p-c2pj"],"ecosystem":"maven","ingestedAt":"2026-08-28T22:26:19.079Z","slug":"CVE-2026-55841","body":"## Overview\n\nGraylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java mishandles field-like text inside quoted values. GLFortiGateSyslogEvent.getFields() uses KV_PATTERN and QUOTED_KV_PATTERN, while SyslogCodec.parse() invokes the FortiGateSyslogEvent parser; crafted values containing = or backslash-escaped quotes can cause embedded keys such as srcip, dstip, date, time, and tz to remove or overwrite original top-level fields or produce an invalid message that Graylog discards. An unauthenticated network sender who can submit syslog messages can therefore manipulate security-log fields or evade logging to obscure malicious activity. This issue is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55841)\n\nAffected packages:\n\n- `org.graylog2:graylog2-server < 6.3.12`\n- `org.graylog2:graylog2-server >= 7.0.0, < 7.0.7`\n- `org.graylog2:graylog2-server >= 7.1.0, < 7.1.2`\n\nPatched in:\n\n- `org.graylog2:graylog2-server 6.3.12`\n- `org.graylog2:graylog2-server 7.0.7`\n- `org.graylog2:graylog2-server 7.1.2`\n\nSource: https://github.com/advisories/GHSA-gqr6-r77p-c2pj","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}