CVE-2026-55841: Graylog Information Disclosure Vulnerability

CVE-2026-55841 Overview

CVE-2026-55841 is a log-injection vulnerability in Graylog's FortiGate key-value syslog parser. The flaw affects Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2, along with Graylog Forwarder versions prior to 7.3. The parser mishandles field-like text inside quoted values, allowing crafted syslog messages to overwrite or remove top-level fields such as srcip, dstip, date, time, and tz. An unauthenticated network attacker who can send syslog traffic to a Graylog input can therefore manipulate security telemetry or force Graylog to discard messages entirely, obscuring malicious activity. The weakness is classified as improper interpretation of message content [CWE-138].

Critical Impact
Unauthenticated attackers can forge or suppress security log fields, undermining the integrity of downstream detection, investigation, and compliance workflows.

Affected Products

Graylog Server versions prior to 6.3.12
Graylog Server 7.0.x prior to 7.0.7 and 7.1.x prior to 7.1.2
Graylog Forwarder versions prior to 7.3

Discovery Timeline

2026-08-28 - CVE-2026-55841 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-55841

Vulnerability Analysis

The defect lives in Graylog's FortiGate syslog handling, specifically GLFortiGateSyslogEvent.getFields() in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and the SyslogCodec.parse() entry point in SyslogCodec.java. SyslogCodec.parse() delegates FortiGate-formatted messages to the FortiGate parser, which extracts key-value pairs using two regular expressions: KV_PATTERN for unquoted pairs and QUOTED_KV_PATTERN for quoted pairs. Neither pattern accounts for = characters or backslash-escaped quotes embedded inside a legitimate quoted value. As a result, tokens inside a quoted string are re-interpreted as their own key-value pairs and merged into the top-level message map. Because embedded keys are written after the legitimate ones, they overwrite prior values such as srcip, dstip, date, time, and tz, or corrupt the map enough that Graylog rejects the message.

Root Cause

The root cause is a parser design flaw: the FortiGate wrapper applies key-value regexes to the raw payload without honoring the quoting semantics of the underlying format. Quoted values are treated as opaque tokens by the sender, but Graylog's parser continues scanning them for additional key=value matches. This is a classic improper-neutralization-of-message-content issue and maps to [CWE-138]. The remediation removes the custom wrapper entirely and upgrades syslog4j from 0.9.61 to 0.9.63, delegating parsing to the upstream implementation that handles quoting correctly.

Attack Vector

Exploitation requires only network access to a Graylog input that accepts syslog data. The attacker sends a syslog message that mimics FortiGate formatting and embeds attacker-controlled key=value pairs inside quoted fields, using = characters or backslash-escaped quotes to smuggle keys through the parser. When Graylog processes the message, the injected keys overwrite the genuine fields, replacing real source or destination addresses with attacker-chosen values or blanking out timestamps. Alternatively, a deliberately malformed payload can produce an invalid message that Graylog silently discards, suppressing evidence of the underlying activity. No authentication, user interaction, or prior foothold is required.

java

// Removed in the fix: Graylog's custom FortiGate wrapper
// Source: https://github.com/Graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f
public class GLFortiGateSyslogEvent extends FortiGateSyslogEvent {
    private static final Pattern KV_PATTERN = Pattern.compile("(\\w+)=([^\\s\"]*)");
    // QUOTED_KV_PATTERN and getFields() reprocess quoted values,
    // allowing embedded key=value tokens to overwrite top-level fields
    // such as srcip, dstip, date, time, and tz.
}

Detection Methods for CVE-2026-55841

Indicators of Compromise

FortiGate-formatted syslog messages containing quoted values whose contents include additional key=value fragments, backslash-escaped quotes, or stray = characters.
Sudden appearance of implausible values in srcip, dstip, date, time, or tz fields, especially values that mirror strings found in message payloads.
Unexpected spikes in message-parse failures or discarded messages on FortiGate syslog inputs.

Detection Strategies

Compare raw syslog payloads at the network boundary with the fields Graylog stores; mismatches on identifier fields indicate parser manipulation.
Alert on FortiGate messages where the same key (for example srcip) is present more than once in the raw payload.
Correlate FortiGate event gaps with firewall-side session logs to surface silently dropped or overwritten records.

Monitoring Recommendations

Track Graylog journal and input-level metrics for increases in rejected or discarded messages tied to FortiGate inputs.
Enable and retain raw message archives so investigators can replay original payloads against a patched parser.
Monitor the version of syslog4j in production Graylog deployments to confirm it is 0.9.63 or later.

How to Mitigate CVE-2026-55841

Immediate Actions Required

Upgrade Graylog Server to 6.3.12, 7.0.7, or 7.1.2, and Graylog Forwarder to 7.3, depending on your deployed branch.
Restrict syslog inputs to trusted network segments and known FortiGate sender IP addresses using firewall or ACL rules.
Review recent FortiGate-derived alerts and dashboards for anomalous or duplicated srcip/dstip values that predate the upgrade.

Patch Information

The fix removes the vulnerable GLFortiGateSyslogEvent wrapper and updates the syslog4j dependency from 0.9.61 to 0.9.63. Relevant references include the GitHub Security Advisory GHSA-gqr6-r77p-c2pj, Pull Request #26050, Pull Request #26057, and commits 793df6e8, 85dc699d, and d5051e60.

Workarounds

Disable FortiGate-formatted syslog inputs on affected Graylog Server versions until the upgrade is applied.
Front the Graylog syslog input with a filtering relay that strips or rejects quoted values containing = characters or escaped quotes.
Route FortiGate telemetry through an alternate codec (for example, plain syslog with structured extractors) that does not invoke the vulnerable FortiGate parser.

bash

# Example: block direct syslog access and restrict to trusted FortiGate sources
iptables -A INPUT -p udp --dport 514 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 514 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 514 -j DROP
iptables -A INPUT -p tcp --dport 514 -j DROP