Logstash EUVD-2026-20526

Attacker must control or compromise Logstash's update endpoint to serve a malicious archive. Requires automatic pipeline reloading enabled. Logstash extracts the archive without path validation, writing files with Logstash process privileges. Remote unauthenticated exploitation against vulnerable Logstash configurations.

The CVSS 8.1 score reflects significant impact potential (High confidentiality, integrity, and availability impact) tempered by high attack complexity (AC:H) and network attack vector requirements. The AC:H designation indicates exploitation requires specific preconditions: the attacker must either compromise an existing update server, perform man-in-the-middle attacks on update channels, or exploit misconfigurations allowing attacker-controlled update sources. The vulnerability requires no authentication (PR:N) and no user interaction (UI:N), making it fully remotely exploitable once preconditions are met. Real-world risk assessment must weigh several factors: (1) Logstash typically operates in backend infrastructure, reducing direct internet exposure but increasing impact if compromised; (2) organizations using Logstash's automatic update features or plugin installation from untrusted repositories face elevated risk; (3) the escalation path to RCE depends on automatic pipeline reloading being enabled, which is not universal; (4) absence of EPSS data and KEV listing suggests no confirmed widespread exploitation, but the technical disclosure provides a clear exploitation blueprint. For environments with internet-facing Logstash instances using automatic updates or plugin repositories without integrity verification, this represents a critical priority. For air-gapped or tightly controlled deployments with manual update processes, risk is substantially lower. The SSVC framework would likely categorize this as 'attend' priority for most enterprise deployments given the potential for automatable exploitation once preconditions are met and the high technical impact of RCE.

An attacker identifies a Logstash 8.15.2 instance configured to automatically download plugins from a third-party repository. The attacker compromises the repository server or performs a man-in-the-middle attack on the HTTP update channel. They craft a malicious plugin archive containing files with path traversal sequences like '../../../etc/logstash/conf.d/malicious.conf', embedding Ruby code that establishes a reverse shell. When Logstash extracts the archive, the traversal sequences bypass directory restrictions, writing the malicious configuration to the pipeline directory. With automatic pipeline reloading enabled, Logstash loads and executes the injected Ruby code within minutes, granting the attacker remote code execution with the privileges of the Logstash service account (often running as root or a highly privileged service user). The attacker pivots to access sensitive log data, credentials stored in Logstash configurations, or uses the compromised system as a foothold into the backend network.