CVE-2026-55841: CWE-138: Improper Neutralization of Special Elements in Graylog2 graylog2-server

Graylog2-server's FortiGate key-value syslog parser improperly neutralizes special elements in syslog messages. Specifically, the parser mishandles quoted values containing '=' or backslash-escaped quotes, which can cause embedded keys such as srcip, dstip, date, time, and tz to overwrite or remove original top-level fields or produce invalid messages discarded by Graylog. This allows an unauthenticated network sender submitting syslog messages to manipulate security log fields or evade logging, potentially obscuring malicious activity. The vulnerability is addressed in Graylog Server versions 6.3.12, 7.0.7, 7.1.2, and Graylog Forwarder version 7.3.

An unauthenticated attacker able to send syslog messages to the Graylog2-server can manipulate or remove critical security log fields, such as source IP or timestamps, or cause messages to be discarded. This can lead to evasion of logging and obscure malicious activity, impacting the integrity of security monitoring. There is no impact on confidentiality or availability reported.

This vulnerability is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2, and Graylog Forwarder version 7.3. Users should upgrade to these versions or later to remediate the issue. No other mitigation guidance is provided by the vendor advisory. Patch status is not explicitly confirmed in the vendor advisory, but the fixed versions are clearly stated.