high · 7.5CVE-2026-55841Aug 28, 2026

CVE-2026-55841: Graylog FortiGate Syslog Parser Field Injection

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

An attacker who can influence syslog messages reaching Graylog can embed fake key-value pairs inside quoted field values to silently overwrite real log fields or cause messages to be discarded…

Packageorg.graylog2:graylog2-server
Ecosystemmaven
Affected< 6.3.12
Fixed in6.3.12
CVE-2026-55841: Graylog FortiGate Syslog Parser Field Injection

The problem

Graylog's FortiGate syslog codec parses messages in a key=value format. Before 6.3.12, the parser did not correctly handle quoted values: it would split on = characters found inside a quoted string and treat what followed as a new key-value pair.

This lets an attacker embed crafted content inside any quoted syslog field. The result is that real fields (such as action, srcip, or severity) can be overwritten with attacker-chosen values, or the message can be made unparseable and silently dropped, hiding malicious activity from analysts.

Proof of concept

A working proof-of-concept for CVE-2026-55841 in org.graylog2:graylog2-server, with the exact payload below.

text
<134>1 2026-01-15T10:00:00Z fw01 fortigate - - - date=2026-01-15 time=10:00:00 devname=fw01 devid=FG100D action=accept srcip=10.0.0.1 dstip=192.168.1.1 url="http://evil.example.com/path?a=b action=drop srcip=0.0.0.0"

FortiGate syslog fields use a key="value" quoting convention. The vulnerable parser did not track whether it was inside a quoted string before tokenizing on = and whitespace. An attacker supplies a quoted value containing embedded space-separated key=value tokens (for example, action=drop srcip=0.0.0.0 inside the url= quoted string).

The parser extracts those tokens as real fields, overwriting the earlier action=accept and srcip= values that appeared before the quoted segment.

The fix (PR #26050, commit 793df6e) taught the parser to treat everything between the opening and closing quote of a value as literal text, so embedded = signs and spaces are never tokenized as additional fields. CWE-138 (Improper Neutralization of Special Elements) applies: the special elements are the = and whitespace delimiters that drive field extraction.

The fix

Upgrade to Graylog 6.3.12, 7.0.7, or 7.1.2. Graylog Cloud was patched automatically. No workaround exists for unpatched versions. Operators can check the Indexing and Processing Failures Index (Graylog Enterprise/Security) to identify messages that were discarded by the broken parser before patching.

Reported by Jose Luis González (Fundación Sarenet) and Borja Marcos (Sarenet).

References: [1][2][3][4][5][6]

Related research