DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55841: CVE-2026-55841: Log Evasion and Tampering in Graylog FortiGate Syslog Parser

#security #cve #cybersecurity

CVE-2026-55841: Log Evasion and Tampering in Graylog FortiGate Syslog Parser

Vulnerability ID: CVE-2026-55841
CVSS Score: 7.5
Published: 2026-08-28

A high-severity log evasion and tampering vulnerability in Graylog's FortiGate key-value syslog parser allows unauthenticated remote attackers to modify, delete, or overwrite critical security log fields, potentially bypassing security controls and monitoring systems.

TL;DR

Unauthenticated attackers can inject specially crafted syslog packets containing specific key-value structures to strip or overwrite top-level log metadata like source IP addresses, timestamps, and routing info, enabling comprehensive defense evasion.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-138: Improper Neutralization of Special Elements
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 7.5 (High)
  • EPSS Score: N/A (Published 2026)
  • Exploit Maturity: PoC / Conceptual
  • KEV Status: Not Listed
  • Impact: Log Tampering, Evasion of Security Monitoring, Data Loss

Affected Systems

  • Graylog Server
  • Graylog Forwarder
  • FortiGate Syslog Ingestion Pipeline
  • Graylog Server: < 6.3.12 (Fixed in: 6.3.12)
  • Graylog Server: >= 7.0.0-alpha.1, < 7.0.7 (Fixed in: 7.0.7)
  • Graylog Server: >= 7.1.0-alpha.1, < 7.1.2 (Fixed in: 7.1.2)
  • Graylog Forwarder: < 7.3.0 (Fixed in: 7.3.0)

Code Analysis

Commit: 793df6e

Upgrade syslog4j dependency to 0.9.63 and refactor FortiGate syslog event processing to rely on native library features.

Mitigation Strategies

  • Upgrade Graylog Server and Graylog Forwarder to fixed versions immediately.
  • Implement network-level Access Control Lists (ACLs) to restrict syslog input port access.
  • Configure generic raw inputs and parse fields via secure custom pipelines as a temporary alternative.

Remediation Steps:

  1. Identify all Graylog Server and Forwarder nodes running FortiGate syslog input codecs.
  2. Apply the software updates to Graylog Server 6.3.12, 7.0.7, 7.1.2, or Graylog Forwarder 7.3.
  3. Restart the Graylog services and verify that the FortiGate inputs are operating using the updated codec.
  4. Verify log integrity by transmitting a simulated payload containing nested equals signs and confirming top-level fields are preserved.

References

Read the full report for CVE-2026-55841 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)