Executive brief
syslog-ng is a widely used tool for collecting and managing system logs. A vulnerability in its SQL database connector could allow an attacker on the same local network to inject malicious database commands. If exploited, this could lead to unauthorized modification of log data or cause the logging service to crash, potentially disrupting security monitoring and compliance operations.
Technical details
A SQL injection vulnerability exists in syslog-ng's afsql module due to a missing sanitization call in the afsql_dd_run_query function. An attacker with the ability to send log messages to a syslog-ng instance configured with an SQL destination can inject malicious SQL commands. The vulnerability is reachable via the adjacent network (AV:A) and requires no authentication or user interaction. Successful exploitation can lead to unauthorized data modification or a denial-of-service condition on the database backend. This issue is not present in default configurations and only affects systems where the SQL driver has been manually enabled. Patches are available in syslog-ng 4.12, Premium Edition 8.2, and Store Box 7.8.
Affected products
- syslog-ng syslog-ng < 4.12
- syslog-ng syslog-ng Premium Edition < 8.2
- syslog-ng syslog-ng Store Box < 7.8
Timeline
- 2026-06-16: advisory: Initial GitHub security advisory published
- 2026-07-20: disclosed: NVD publication date