This vulnerability (CVE-2026-56748) arises from improper handling of symbolic links in the Pack Git import feature of Cribl Stream prior to version 4.18.2. An attacker with authenticated access and specific permissions (Pack import and pipeline preview) can craft a Git repository with symbolic links in the functions directory of a pack. When imported, these symbolic links are not properly validated, enabling the attacker to execute arbitrary code with the privileges of the Cribl server process. The CVSS 4.0 base score is 8.7, reflecting high impact and exploitability under these conditions. No official remediation level or patch information is currently provided, and no known exploits are reported in the wild.

Successful exploitation allows remote authenticated attackers with specific permissions to execute arbitrary code as the Cribl server process, potentially compromising the server's integrity and confidentiality. This can lead to full control over the affected Cribl Stream instance and any data or operations it manages.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Pack import and pipeline preview permissions to trusted users only and monitor for suspicious activity related to Git pack imports. Avoid importing packs from untrusted sources.