Is CVE-2026-41504 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41504 being exploited in the wild.

How severe is CVE-2026-41504?

Medium severity, with a CVSS score of 5.8, published 12 October 2026.

Which products and versions are affected?

Coraza 3.0.0 through 3.7.0 when using SecAuditLogFormat Native; github.com/corazawaf/coraza (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v2 (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v3 (Go) >= 3.0.0, <= 3.7.0, SEMVER:introduced=3.0.0,fixed=3.8.0.

How is CVE-2026-41504 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41504?

Check whether you run Coraza, github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41504: Coraza CRLF injection in Native audit-log format

Q: Is there a fix for CVE-2026-41504?

Yes. github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.0 or later. Until then: Deployments using JSON or OCSF audit-log formats are unaffected. Alternatively, disable Native audit logging by switching to `SecAuditLogFormat JSON` or `SecAuditLogFormat OCSF`, or disable audit logging entirely with `SecAuditEngine Off`. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-41504 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-41504?

Check whether you run Coraza, github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41504 · Severity: medium · CVSS 5.8 · Published 2026-10-12

Coraza is a web application firewall that logs security events to audit files. When configured to use the Native audit-log format (the default), attackers can inject newline characters into request bodies and headers, allowing them to forge fake log entries that appear identical to genuine security alerts. This enables attackers to hide attacks, shift blame to other IP addresses, or confuse security monitoring systems.

Technologies: Coraza, github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go), github.com/corazawaf/coraza/v3 (Go). Vendors: Coraza, Go.

Quick answers

Is CVE-2026-41504 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41504 being exploited in the wild.
How severe is CVE-2026-41504?: Medium severity, with a CVSS score of 5.8, published 12 October 2026.
Which products and versions are affected?: Coraza 3.0.0 through 3.7.0 when using SecAuditLogFormat Native; github.com/corazawaf/coraza (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v2 (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v3 (Go) >= 3.0.0, <= 3.7.0, SEMVER:introduced=3.0.0,fixed=3.8.0.
Is there a fix for CVE-2026-41504?: Yes. github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.0 or later. Until then: Deployments using JSON or OCSF audit-log formats are unaffected. Alternatively, disable Native audit logging by switching to `SecAuditLogFormat JSON` or `SecAuditLogFormat OCSF`, or disable audit logging entirely with `SecAuditEngine Off`. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41504 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41504?: Check whether you run Coraza, github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.0 or later
```
go get github.com/corazawaf/coraza/v3@v3.8.0
```

Deployments using JSON or OCSF audit-log formats are unaffected. Alternatively, disable Native audit logging by switching to `SecAuditLogFormat JSON` or `SecAuditLogFormat OCSF`, or disable audit logging entirely with `SecAuditEngine Off`.

Technical details

The Native audit-log formatter in `internal/auditlog/formats.go` writes attacker-controlled request bodies, headers, error messages, and rule data directly to the log stream without escaping carriage return (`\r`) or newline (`\n`) characters. The log format uses line-based structural delimiters, so injected newlines break the integrity of individual audit records. Exploitation requires ability to control request body (reachable via standard HTTP) or request headers (reachable in non-net/http integrations like HAProxy or Envoy); no authentication or user interaction required.

Affected products

Coraza Coraza 3.0.0 through 3.7.0 when using SecAuditLogFormat Native

Identifiers

CVE-2026-41504
GHSA-prpw-wwv7-xjjr
GO-2026-6669

Timeline

2026-10-06: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.