syslog-ng EUVD-2026-46031

Exploitation requires that the target has manually configured syslog-ng's afsql SQL destination driver (sql() destination) to write logs into a database - this is explicitly NOT part of the default configuration and is the primary limiting factor. The attacker must additionally be able to deliver an untrusted log message into that pipeline (the 'untrusted source' named in the advisory), and per the CVSS vector reach the daemon over an adjacent network path (AV:A) with no authentication (PR:N) and no user interaction (UI:N). Deployments running default syslog-ng without the SQL driver, or that only ingest logs from trusted local sources, are not exploitable.

The vendor CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, base 7.1) indicates an adjacent, low-complexity, unauthenticated path with no confidentiality loss but low integrity and high availability impact - consistent with malformed SQL corrupting inserts or crashing/locking the database rather than exfiltrating data. The single most important mitigating signal is stated in the description itself: this is NOT the default configuration - the afsql SQL driver must be manually configured - which sharply narrows the real-world attack surface below what the 7.1 score suggests. No EPSS score was provided, there is no CISA KEV entry, and no POC has been supplied, so all three exploitation-likelihood signals are either absent or negative. One tension worth flagging: the vendor rates C:N even though SQL injection can often enable data reads via subqueries - this may reflect the specific INSERT-oriented code path, but defenders using a database that shares the SQLi surface with sensitive tables should independently verify confidentiality exposure. Net: a genuine, patch-worthy flaw for the subset of operators using afsql, but low urgency for the majority running default configurations.

An organization configures syslog-ng with the afsql driver to store logs in a database and accepts syslog messages from network hosts. An attacker who can send log lines to that collector embeds SQL control characters in a message field (e.g., hostname or program name) that is templated into the INSERT statement, causing the injected SQL to execute against the logging database and corrupt data or disrupt the logging service. No public POC has been identified at time of analysis, and successful exploitation requires the non-default SQL driver to be enabled.