CVE-2026-55841High· 7.5▾ TwilightGraylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/c…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java mishandles field-like text inside quoted values. GLFortiGateSyslogEvent.getFields() uses KV_PATTERN and QUOTED_KV_PATTERN, while SyslogCodec.parse() invokes the FortiGateSyslogEvent parser; crafted values containing = or backslash-escaped quotes can cause embedded keys such as srcip, dstip, date, time, and tz to remove or overwrite original top-level fields or produce an invalid message that Graylog discards. An unauthenticated network sender who can submit syslog messages can therefore manipulate security-log fields or evade logging to obscure malicious activity. This issue is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.graylog2:graylog2-server < 6.3.12org.graylog2:graylog2-server >= 7.0.0, < 7.0.7org.graylog2:graylog2-server >= 7.1.0, < 7.1.2Patched in:
org.graylog2:graylog2-server 6.3.12org.graylog2:graylog2-server 7.0.7org.graylog2:graylog2-server 7.1.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55867MediumGraylog is a free and open log management platform
CVE-2026-55425Medium· 5.0Graylog is a free and open log management platform
CVE-2026-69190Medium· 6.3Graylog is a free and open log management platform
CVE-2026-92789Medium· 6.5Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects