CVE-2026-13006: QOS.CH logback-core arbitrary code execution in conditional configuration

CVE-2026-13006 · Severity: info · CVSS 7 · Published 2026-06-24

Logback is a widely used Java logging library. A vulnerability in how it processes configuration files allows an attacker with existing high-level access to execute malicious code on the server. To exploit this, an attacker must be able to modify the application's configuration files or environment variables, and the system must use the optional Janino library. While this requires significant prior access, it could allow an attacker to escalate their control over the affected application.

Quick answers

Is CVE-2026-13006 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-13006 being exploited in the wild.
How severe is CVE-2026-13006?
Informational severity, with a CVSS score of 7, published 24 June 2026.
Which products and versions are affected?
QOS.CH logback-core >= 0.9.20, <= 1.5.34.
Is there a fix for CVE-2026-13006?
A patch was published on 2026-06-23: Release of version 1.5.35 fixes the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13006 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-13006?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Arbitrary Code Execution (ACE) vulnerability exists in logback-core versions up to 1.5.34 due to improper input validation in the 'condition' attribute of <if> elements. Specifically, the library fails to reject unicode escape sequences (\u and \U), which can be used to bypass existing protections against the 'new' operator in Janino-evaluated conditions. An attacker with write access to the logback configuration file, or the ability to inject environment variables pointing to a malicious configuration file, can achieve code execution if the Janino library is on the classpath. This vulnerability is a bypass for CVE-2025-11226. Users should upgrade to version 1.5.35 or later.

Affected products

  • QOS.CH logback-core >= 0.9.20, <= 1.5.34

Timeline

  • 2026-06-23: patched: Release of version 1.5.35 fixes the issue.
  • 2026-06-24: advisory: CVE-2026-13006 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.