CVE-2026-55841

Graylog's FortiGate key-value syslog parser mishandles field-like text inside quoted syslog values, so crafted values containing '=' characters or backslash-escaped quotes inject embedded keys such as srcip, dstip, date, time, and tz into parsed messages. An unauthenticated network sender who can submit syslog messages to a vulnerable Graylog instance can use these crafted values to remove or overwrite original top-level log fields, or to craft messages that parse as invalid and are silently discarded. The attacker gains the ability to manipulate or suppress security-log fields - obscuring malicious activity in logs used for security monitoring - with no direct confidentiality impact (CVSS 3.1 7.5, integrity-focused, CWE-138). The flaw affects Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder versions prior to 7.3, wherever the SyslogCodec.parse() path invokes the FortiGateSyslogEvent parser (GLFortiGateSyslogEvent.getFields() using KV_PATTERN/QUOTED_KV_PATTERN). No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.4% probability of exploitation within 30 days (percentile 29).

What to do: Upgrade Graylog Server to 6.3.12, 7.0.7, or 7.1.2 (matching your installed branch) and Graylog Forwarder to 7.3. Until patched, restrict which network sources can submit syslog messages to Graylog inputs (firewall or allowlist the syslog port) and review recent ingest for messages with missing or unexpected srcip/dstip/date/time/tz fields, or unexplained message drops, that could indicate tampering.