Which versions of Cribl Stream are affected by CVE-2026-56748?

Cribl Stream versions before 4.18.2 contain a high-severity vulnerability (CVE-2026-56748) that allows authenticated users with pack import and pipeline preview permissions to execute arbitrary code…. A patch is available.

How to fix or mitigate CVE-2026-56748?

Within 24 hours, review and restrict pack import and pipeline preview permissions to only essential, trusted users, and monitor server logs for any unusual activity. Within 7 days, implement network segmentation to limit lateral movement, deploy application control (e.g., Windows AppLocker or Linux eBPF) to block unauthorized code execution, and enable enhanced auditing on Cribl Stream servers. Within 30 days, develop a patch deployment plan for when Cribl releases the fix, and consider additional logging and alerting for suspicious file system changes or process executions.

Cribl Stream CVE-2026-56748

Q: What is the CVSS score of CVE-2026-56748?

CVE-2026-56748 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-49570 HIGH

UNIX Symbolic Link (Symlink) Following (CWE-61)

2026-07-27 Cribl

GHSA-xj69-cqwc-2w67

RCE Cribl Stream

8.7

CVSS 4.0 · Vendor: Cribl

Severity by source

Vendor (Cribl) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Cribl) · only source for this CVE.

CVSS VectorVendor: Cribl

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 27, 2026 - 21:17 EUVD

Analysis Generated

Jul 27, 2026 - 20:22 vuln.today

CVSS changed

Jul 27, 2026 - 20:22 NVD

8.8 (HIGH) 8.7 (HIGH)

CVE Published

Jul 27, 2026 - 19:27 cve.org

HIGH 8.7

DescriptionCVE.org

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link in the pack's functions directory.

AnalysisAI

Arbitrary code execution in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to compromise the server. The attacker can execute arbitrary code as the Cribl server process by importing a crafted Git repository containing a symbolic link in the pack's functions directory. No public exploit is known, and there is no evidence of active exploitation at this time.