Graylog CVE-2026-55841

Exploitation requires network access to a Graylog Syslog input port (typically UDP/514 or TCP/514) on a Graylog Server or Forwarder instance running an affected version. The Graylog instance must have a Syslog input configured to receive messages - this is a user-provisioned input, not enabled by default, but common in FortiGate-integrated deployments. The syslog protocol itself does not authenticate senders, consistent with the CVSS PR:N rating; however, an attacker must be able to route packets to the Graylog syslog port. The vulnerable parser path is triggered specifically when Graylog identifies the incoming message as FortiGate key-value syslog format. Exploitation is strictly limited to corrupting or discarding log records within Graylog; it does not enable code execution, data exfiltration, privilege escalation, or impact to any system beyond the integrity of the Graylog message store. Field overwrite requires crafting values containing = signs; message discard requires crafting a message that produces parsing errors.

CVSS 7.5 with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N characterizes this as high-severity, network-exploitable with no authentication barrier - consistent with the description's explicit 'unauthenticated network sender' phrasing. EPSS data is absent from the provided intelligence feed and cannot be assessed. KEV status is negative (not listed by CISA), and no public exploit code has been identified at time of analysis. The real-world risk profile is asymmetric: the flaw cannot yield code execution, credential access, or lateral movement - it is an integrity and anti-forensics primitive. Its danger is highest in Security Operations Center environments where Graylog is the authoritative log aggregation plane for FortiGate firewall telemetry, where corrupted srcip/dstip fields or discarded events could blind detection rules and impair incident response. The attack surface is bounded to Graylog deployments that (a) have a Syslog input enabled and (b) receive FortiGate-format key-value syslog - narrowing the population of affected organizations but not negating risk for those that qualify. No conflicts between the CVSS vector, the description, and the patch diff were identified.

An attacker with network access to a Graylog syslog input port - whether by compromising a FortiGate device, spoofing syslog UDP packets, or accessing an exposed TCP syslog listener - crafts a FortiGate-format message containing a URL field with embedded key=value pairs matching real field names, such as: url="/?srcip=192.168.1.100&dstip=10.0.0.5". The vulnerable GLFortiGateSyslogEvent parser detects srcip and dstip as apparent embedded keys within the URL value and removes them from the final parsed field set, erasing the attacker's legitimate source and destination addresses from the security log. This enables the attacker to evade IP-based detection rules and blind forensic analysts to the true network path of their activity. No public proof-of-concept exists, but the PR #26050 test cases published by Graylog demonstrate the exact crafted payloads required.