Executive brief
Graylog is a centralized log management and analysis platform used to collect and parse syslog messages from network devices like Fortigate firewalls. A parsing vulnerability allows attackers to inject specially crafted messages that modify or delete fields from legitimate log records, or cause Graylog to discard messages entirely. This breaks the integrity of security logs and enables attackers to hide their activity from audit trails and security investigations.
Technical details
The vulnerability is a special-element injection flaw (CWE-138) in Graylog's parsing logic for key-value syslog messages originating from Fortigate devices. When processing these messages, the parser fails to properly neutralize or escape special control elements, allowing an attacker to inject additional key-value pairs that overwrite legitimate message fields. Alternatively, attackers can craft invalid payloads that cause Graylog to reject and discard the entire message. The attack is network-accessible and requires no authentication or user interaction. An unauthenticated attacker on the network with the ability to send syslog messages to Graylog (or via a Fortigate device) can exploit this to tamper with or delete audit logs, facilitating log evasion. Patches are available in versions 6.3.12, 7.0.7, and 7.1.2.
Affected products
- Graylog graylog2-server < 6.3.12, >= 7.0.0 and < 7.0.7, >= 7.1.0 and < 7.1.2
Timeline
- 2026-06-24: disclosed: Vulnerability disclosed to Graylog
- 2026-08-28: advisory: Advisory published (GHSA-gqr6-r77p-c2pj, CVE-2026-55841)
- 2026-06-24: patched: Patches released in versions 6.3.12, 7.0.7, 7.1.2
References
- https://api.github.com/users/joseluisgonzalezca
- https://github.com/joseluisgonzalezca
- https://api.github.com/users/joseluisgonzalezca/gists%7B/gist_id%7D
- https://api.github.com/users/joseluisgonzalezca/repos
- https://avatars.githubusercontent.com/u/90149790?v=4
- https://api.github.com/users/joseluisgonzalezca/events%7B/privacy%7D