{"id":"CVE-2026-55841","summary":"Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message","details":"Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java mishandles field-like text inside quoted values. GLFortiGateSyslogEvent.getFields() uses KV_PATTERN and QUOTED_KV_PATTERN, while SyslogCodec.parse() invokes the FortiGateSyslogEvent parser; crafted values containing = or backslash-escaped quotes can cause embedded keys such as srcip, dstip, date, time, and tz to remove or overwrite original top-level fields or produce an invalid message that Graylog discards. An unauthenticated network sender who can submit syslog messages can therefore manipulate security-log fields or evade logging to obscure malicious activity. This issue is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3.","aliases":["GHSA-gqr6-r77p-c2pj"],"modified":"2026-09-01T14:10:17.810188Z","published":"2026-08-28T22:11:08.747Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-138"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55841.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55841.json"},{"type":"ADVISORY","url":"https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-gqr6-r77p-c2pj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55841"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/commit/d5051e604c962ef3d4e5e8e434d0ff4907d2140d"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/pull/26050"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/pull/26056"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/pull/26057"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/pull/26059"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/graylog2/graylog2-server","events":[{"introduced":"0"},{"introduced":"dac42698ecd7e1be0652802e6308c55b0fc5cdca"},{"introduced":"a9355313df2c2106f48684eb47617980ab4d42db"},{"fixed":"fd62097b3ac4d3f18641e973e4823ed9bf663122"},{"fixed":"5cd524ef532ecf6c77fe5efebcd0d2a5143f893c"},{"fixed":"adc626831f3170716845df46ae9237b7e93e1d7d"},{"fixed":"793df6e8202ea55c15a762e47a2a8a775961dd3f"},{"fixed":"85dc699d6319aea433583dc239077a3a799c8627"},{"fixed":"d5051e604c962ef3d4e5e8e434d0ff4907d2140d"},{"fixed":"dde76d7432c469887d9a95c208083c5f0f73c70d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.3.12"},{"introduced":"7.0.0-alpha.1"},{"fixed":"7.0.7"},{"introduced":"7.1.0-alpha.1"},{"fixed":"7.1.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["7.1.1","7.1.0","7.1.0-rc.2","7.1.0-rc.1","7.1.0-beta.2","6.3.11","7.0.6","7.1.0-beta.1","7.1.0-alpha.3","6.3.10","7.0.5","6.3.9","7.0.4","7.1.0-alpha.2","6.3.8","7.0.3","6.3.7","7.0.2","7.1.0-alpha.1","7.0.1","6.3.6","7.0.0","7.0.0-rc.2","7.0.0-rc.1","7.0.0-beta.5","6.3.5","7.0.0-beta.4","7.0.0-beta.3","6.3.4","7.0.0-beta.2","7.0.0-beta.1","6.3.3","7.0.0-alpha.2","6.3.2","7.0.0-alpha.1","6.3.1","6.3.0","6.3.0-rc.2","6.3.0-rc.1","6.3.0-beta.5","6.3.0-beta.4","6.3.0-beta.3","6.3.0-beta.2","6.3.0-beta.1","6.3.0-alpha.4","6.3.0-alpha.3","6.3.0-alpha.2","6.3.0-alpha.1","6.2.0-rc.1","6.2.0-beta.4","6.2.0-beta.3","6.2.0-beta.2","6.2.0-beta.1","6.2.0-alpha.2","6.2.0-alpha.1","6.1.0-rc.1","6.1.0-beta.4","6.1.0-beta.3","6.1.0-beta.2","6.1.0-beta.1","6.1.0-alpha.8","6.1.0-alpha.7","6.1.0-alpha.6","6.1.0-alpha.5","6.1.0-alpha.4","6.1.0-alpha.3","6.1.0-alpha.2","6.1.0-alpha.1","6.0.0-rc.1","6.0.0-beta.5","6.0.0-beta.4","6.0.0-beta.3","6.0.0-beta.2","6.0.0-beta.1","6.0.0-alpha.3","6.0.0-alpha.2","6.0.0-alpha.1","5.2.0-rc.1","5.2.0-beta.3","5.2.0-beta.2","5.2.0-beta.1","5.2.0-alpha.1","5.1.0-rc.1","5.1.0-beta.3","5.1.0-beta.2","5.1.0-beta.1","5.0.0-rc.1","5.0.0-beta.5","5.0.0-beta.4","5.0.0-beta.3","5.0.0-beta.2","5.0.0-beta.1","5.0.0-alpha.1","4.3.0-rc.1","4.3.0-beta.3","4.3.0-beta.2","4.3.0-beta.1","4.2.0-beta.1","4.1.0","4.1.0-rc.1","4.1.0-beta.2","4.1.0-beta.1","4.0.0-rc.1","4.0.0-beta.4","4.0.0-beta.3","4.0.0-beta.2","4.0.0-beta.1","3.3.0-rc.1","3.3.0-beta.3","3.3.0-beta.2","3.3.0-beta.1","3.2.0-rc.1","3.2.0-beta.4","3.2.0-beta.3","3.2.0-beta.2","3.2.0-beta.1","3.1.0","3.1.0-rc.2","3.1.0-rc.1","3.1.0-beta.3","3.1.0-beta.2","3.1.0-beta.1","3.0.0-beta.1","3.0.0-alpha.5","3.0.0-alpha.4","3.0.0-alpha.3","3.0.0-alpha.2","3.0.0-alpha.1","3.0.0-alpha.0","2.4.0-alpha.3","2.4.0-alpha.2","2.4.0-alpha.1","2.3.0-rc.1","2.3.0-beta.1","2.3.0-alpha.3","2.3.0-alpha.2","2.3.0-alpha.1","2.2.0","2.2.0-rc.1","2.2.0-beta.6","2.2.0-beta.5","2.2.0-beta.4","2.2.0-beta.3","2.2.0-beta.2","2.2.0-beta.1","2.2.0-alpha.4","2.2.0-alpha.3","2.2.0-alpha.2","2.2.0-alpha.1","2.1.0-rc.1","2.1.0-beta.4","2.1.0-beta.3","2.1.0-beta.2","2.1.0-beta.1","2.1.0-alpha.2","2.1.0-alpha.1","2.0.0-beta.3","2.0.0-beta.2","2.0.0-beta.1","2.0.0-alpha.5","2.0.0-alpha.4","2.0.0-alpha.3","2.0.0-alpha.2","2.0.0-alpha.1","1.2.0-rc.4","1.2.0-rc.3","1.2.0-rc.2","1.2.0-rc.1","1.1.0-rc.1","1.1.0-beta.3","1.1.0-beta.2","1.1.0-beta.1","1.0.0-beta.1","0.21.0-rc.1","0.21.0-beta4","0.21.0-beta3","0.21.0-beta2","0.21.0-beta1","v0.20.0-rc.1-1","0.20.0-rc.1-1","0.20.0-rc.1","0.20.0-preview.6","0.20.0-preview.5","0.20.0-preview.4","0.20.0-preview.3","0.20.0-preview.2","v0.20.0-preview.1","0.20.0-preview.1","0.11.0","0.10.0","0.10.0-rc.4","0.10.0-rc.3","0.10.0-rc.2","0.10.0-rc.1","0.10.0-preview.2","0.9.7-preview.1","0.9.6","0.9.6-beta","0.9.6-PREVIEW.3","0.9.6-PREVIEW.2","0.9.6-PREVIEW","0.9.5p1","0.9.5","0.9.4p1","0.9.4","0.9.3","0.9.2","0.9.1","0.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55841.json","vanir_signatures_modified":"2026-09-01T14:10:17Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d","target":{"file":"graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java"},"deprecated":false,"digest":{"line_hashes":["15362446443876422941302116121430697273","87363060031788600291146251482431208907","142563972264437719276925212889253680517","279641879984668709823898754400064265155","59631639438567229310350670061053344940","294995614133824592350078025824309437690","4169884190394616061853945079528622428","296157472858476058314775659311726157960","309706790420547297554883015137944032163","325561064640539043766225136483341798948","131422881970629110722005493850014154854","180193110781738444384922475959849293281","179505420130240855232519323926324128580","82857527865893591583358080384239562916","259467936089202316878613877197598759908","249486976892969964465605102581367974488","197582608243576381800270104275372599088","144931851415440112903114155728419047678","3972145865375821819176435214827962918","141181810583293165749102648986995716309","196648260424735418313989979597310267065","163745351664781463700151443176822741118","52002965412930771717325984340023745694","263363652826078568824819868002265078445","269824758218695936869505536230757116443","98174471838803670294902720184648527244","58055859803695640475990503145022486318","180111087316262008212385216071056988976","164279810374869493711692214849343187021","187907437099871657069614725870404597808","110324764065556357123831084359114594453","12689079880980314770530599917810251631","302610303621857111509314079126959667057"],"threshold":0.9},"id":"CVE-2026-55841-04ec47d9"},{"signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d","target":{"file":"graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java","function":"GLFortiGateSyslogEvent"},"deprecated":false,"digest":{"function_hash":"329843847068552324655743178063563805308","length":68},"id":"CVE-2026-55841-0e6d5aa6","signature_type":"Function"},{"id":"CVE-2026-55841-27f5a363","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f","target":{"file":"graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java"},"deprecated":false,"digest":{"line_hashes":["104599310443839456948951619663259869130","47694366066253477461081445870832984492","315400544180267323138870657385856486546","223984200929579114318453227088878249701","280524511235448493085252442217958163117","130613388634643825772252876001576432771","1740651935478791410299279390482502125","212032248164427625133915601252929713940","161622807411533134244444557897651141284","24549162730389765243366254185434072577","87824252477587183429121953135565411795","12963804225298521908397641710967828696","329564048774202197813264483685327432201"],"threshold":0.9}},{"digest":{"function_hash":"86086632338616361761655710191277153799","length":557},"id":"CVE-2026-55841-2f9aa218","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d","target":{"file":"graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java","function":"getFields"},"deprecated":false},{"source":"https://github.com/graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f","target":{"file":"graylog2-server/src/test/java/org/graylog2/inputs/codecs/SyslogCodecTest.java"},"deprecated":false,"digest":{"line_hashes":["308869814200975557154812010259433697522","73887472117018902670438594284674070072","163713028992810329145584129981731837494"],"threshold":0.9},"id":"CVE-2026-55841-302c2008","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-55841-4f8ffe18","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/d5051e604c962ef3d4e5e8e434d0ff4907d2140d","target":{"file":"graylog2-server/src/test/java/org/graylog2/inputs/codecs/SyslogCodecTest.java"},"deprecated":false,"digest":{"line_hashes":["89434528082666317534464821002429643359","275599133969428259503054527328334980489","163713028992810329145584129981731837494"],"threshold":0.9}},{"source":"https://github.com/graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627","target":{"function":"getFields","file":"graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java"},"deprecated":false,"digest":{"function_hash":"86086632338616361761655710191277153799","length":557},"id":"CVE-2026-55841-4fdb4e9f","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627","target":{"file":"graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java"},"deprecated":false,"digest":{"line_hashes":["15362446443876422941302116121430697273","87363060031788600291146251482431208907","142563972264437719276925212889253680517","279641879984668709823898754400064265155","59631639438567229310350670061053344940","294995614133824592350078025824309437690","4169884190394616061853945079528622428","296157472858476058314775659311726157960","309706790420547297554883015137944032163","325561064640539043766225136483341798948","131422881970629110722005493850014154854","180193110781738444384922475959849293281","179505420130240855232519323926324128580","82857527865893591583358080384239562916","259467936089202316878613877197598759908","249486976892969964465605102581367974488","197582608243576381800270104275372599088","144931851415440112903114155728419047678","3972145865375821819176435214827962918","141181810583293165749102648986995716309","196648260424735418313989979597310267065","163745351664781463700151443176822741118","52002965412930771717325984340023745694","263363652826078568824819868002265078445","269824758218695936869505536230757116443","98174471838803670294902720184648527244","58055859803695640475990503145022486318","180111087316262008212385216071056988976","164279810374869493711692214849343187021","187907437099871657069614725870404597808","110324764065556357123831084359114594453","12689079880980314770530599917810251631","302610303621857111509314079126959667057"],"threshold":0.9},"id":"CVE-2026-55841-5327e71b","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["308869814200975557154812010259433697522","73887472117018902670438594284674070072","163713028992810329145584129981731837494"],"threshold":0.9},"id":"CVE-2026-55841-5b4ce8b6","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627","target":{"file":"graylog2-server/src/test/java/org/graylog2/inputs/codecs/SyslogCodecTest.java"}},{"source":"https://github.com/graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627","target":{"file":"graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java","function":"GLFortiGateSyslogEvent"},"deprecated":false,"digest":{"function_hash":"329843847068552324655743178063563805308","length":68},"id":"CVE-2026-55841-5e06e2f4","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["308869814200975557154812010259433697522","73887472117018902670438594284674070072","163713028992810329145584129981731837494"],"threshold":0.9},"id":"CVE-2026-55841-61d03d85","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d","target":{"file":"graylog2-server/src/test/java/org/graylog2/inputs/codecs/SyslogCodecTest.java"}},{"source":"https://github.com/graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d","target":{"file":"graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java"},"deprecated":false,"digest":{"line_hashes":["104599310443839456948951619663259869130","47694366066253477461081445870832984492","315400544180267323138870657385856486546","223984200929579114318453227088878249701","280524511235448493085252442217958163117","130613388634643825772252876001576432771","1740651935478791410299279390482502125","212032248164427625133915601252929713940","161622807411533134244444557897651141284","24549162730389765243366254185434072577","87824252477587183429121953135565411795","12963804225298521908397641710967828696","329564048774202197813264483685327432201"],"threshold":0.9},"id":"CVE-2026-55841-8250c1ed","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"86086632338616361761655710191277153799","length":557},"id":"CVE-2026-55841-a0092e51","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f","target":{"file":"graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java","function":"getFields"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627","target":{"file":"graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java"},"deprecated":false,"digest":{"line_hashes":["104599310443839456948951619663259869130","47694366066253477461081445870832984492","315400544180267323138870657385856486546","223984200929579114318453227088878249701","280524511235448493085252442217958163117","130613388634643825772252876001576432771","1740651935478791410299279390482502125","212032248164427625133915601252929713940","161622807411533134244444557897651141284","24549162730389765243366254185434072577","87824252477587183429121953135565411795","12963804225298521908397641710967828696","329564048774202197813264483685327432201"],"threshold":0.9},"id":"CVE-2026-55841-bc62740e","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f","target":{"file":"graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java","function":"GLFortiGateSyslogEvent"},"deprecated":false,"digest":{"function_hash":"329843847068552324655743178063563805308","length":68},"id":"CVE-2026-55841-cfa2d8ff","signature_type":"Function"},{"source":"https://github.com/graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f","target":{"file":"graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java"},"deprecated":false,"digest":{"line_hashes":["15362446443876422941302116121430697273","87363060031788600291146251482431208907","142563972264437719276925212889253680517","279641879984668709823898754400064265155","59631639438567229310350670061053344940","294995614133824592350078025824309437690","4169884190394616061853945079528622428","296157472858476058314775659311726157960","309706790420547297554883015137944032163","325561064640539043766225136483341798948","131422881970629110722005493850014154854","180193110781738444384922475959849293281","179505420130240855232519323926324128580","82857527865893591583358080384239562916","259467936089202316878613877197598759908","249486976892969964465605102581367974488","197582608243576381800270104275372599088","144931851415440112903114155728419047678","3972145865375821819176435214827962918","141181810583293165749102648986995716309","196648260424735418313989979597310267065","163745351664781463700151443176822741118","52002965412930771717325984340023745694","263363652826078568824819868002265078445","269824758218695936869505536230757116443","98174471838803670294902720184648527244","58055859803695640475990503145022486318","180111087316262008212385216071056988976","164279810374869493711692214849343187021","187907437099871657069614725870404597808","110324764065556357123831084359114594453","12689079880980314770530599917810251631","302610303621857111509314079126959667057"],"threshold":0.9},"id":"CVE-2026-55841-eb9f6821","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}