CVE-2026-55841

Executive Summary

CVE-2026-55841 is a high-severity input validation flaw (CWE-138 — Improper Neutralization of Special Elements) in Graylog's FortiGate key-value (KV) syslog parser. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 (and Graylog Forwarder version 7.3), a flaw in how the parser handles field-like text inside quoted values allows an unauthenticated network sender to inject key-value pairs that can overwrite or remove original top-level syslog fields such as srcip, dstip, date, time, and tz. An attacker who can send syslog messages to a Graylog receiver can consequently tamper with security-log fidelity or cause messages to be entirely discarded, effectively evading logging of malicious activity. The CVSS score is 7.5 (High) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, reflecting a significant integrity impact on log data with no confidentiality compromise and no authentication requirement. No public exploit code, CISA KEV listing, or EPSS score currently exists.

Technical Analysis

The vulnerability resides in Graylog's FortiGate syslog codec — a specialized parser used to decode syslog messages originating from Fortinet FortiGate firewall devices. The affected source files are explicitly named in the advisory:

• graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java
• graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java

Vulnerability Mechanism. The root cause is improper handling of quoted values during key-value pattern matching. The class GLFortiGateSyslogEvent uses two regular expression patterns — KV_PATTERN and QUOTED_KV_PATTERN — to parse FortiGate-style syslog messages, which typically take the form of key=value pairs (e.g., srcip=10.0.0.1 dstip=192.168.1.1 action=accept). The parser separates these pairs by looking for = signs and whitespace delimiters.

The flaw is triggered when a value is wrapped in quotes and contains characters that the parser misinterprets as key-value delimiters. Specifically:

1. Equals signs inside quoted values: If an attacker supplies a quoted string that itself contains = (e.g., msg="token=abc123"), the parser may interpret the inner token=abc123 as a separate top-level key-value pair rather than as part of the quoted payload.

2. Backslash-escaped quotes: If a quoted value contains escaped quote characters (e.g., \"), the parser's state machine loses track of quote boundaries. This can cause subsequent text to be treated as new, unquoted key-value pairs.

The result is that embedded keys such as srcip, dstip, date, time, and tz — which are legitimate FortiGate field names — can be injected inside quoted values and will then remove or overwrite the original top-level fields in the parsed event structure. The SyslogCodec.parse() method invokes the FortiGateSyslogEvent parser, so the flaw propagates into the general syslog ingestion path, not just into FortiGate-specific pipelines.

Message Discard Scenario. In a second variant of the attack, the malformed key-value structure can produce an "invalid message" that Graylog's validation logic rejects, causing the entire syslog event to be dropped. This is an availability-adjacent integrity impact: the attacker does not crash the server (CVSS AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N reflects no availability effect) but can selectively prevent specific log entries from being stored, effectively creating blind spots in the security audit trail.

Attack Surface. The affected component is the syslog input path — any Graylog node configured with a TCP or UDP syslog input (standard ports 514, 1514, or custom ports) is exposed. Critically, the CVSS vector indicates no authentication is required (PR:N) and no user interaction is needed (UI:N). The attack is purely network-based (AV:N) and requires low complexity (AC:L). This means any host on the network that can reach the Graylog syslog listener can exploit this flaw, regardless of whether they are legitimate log sources.

Code-Level Explanation (Derived from Description). The getFields() method of GLFortiGateSyslogEvent applies both KV_PATTERN and QUOTED_KV_PATTERN sequentially. A likely implementation pattern is: first match unquoted key=value pairs with KV_PATTERN, then process quoted segments with QUOTED_KV_PATTERN. If the quoted pattern fails to properly account for escaped quotes or embedded equals signs, the extracted "value" fragment is fed back into the KV extraction logic, producing spurious keys. Since the result is a Map<String, String> where later entries overwrite earlier ones with the same key, an attacker-controlled embedded srcip= will clobber the legitimate srcip field parsed earlier in the same message.

Exploitation Scenarios

The attack chain is derived strictly from the vulnerability description. No public PoC exists; the following is an inference from the vulnerability mechanism described in the NVD entry.

Stage 1 — Reconnaissance / Target Identification. An attacker identifies Graylog instances by scanning for open syslog ports (UDP/TCP 514, 1514, or common alternate ports) or by using Shodan/Censys queries for Graylog web interfaces (default port 9000) that reveal syslog ingestion endpoints. Since the vulnerability requires no authentication, target selection is trivial; the attacker needs only to know the IP and port of a listening syslog input.

Stage 2 — Flaw Trigger. The attacker crafts a syslog message in FortiGate format. A heavily simplified conceptual payload (the exact syntax is not disclosed in the advisory) would involve a field whose value is enclosed in double quotes and contains either a literal = character or a backslash-escaped quote. For example, a message containing a substring like msg="description=attack_srcip=192.168.1.66" — where the inner srcip= is treated as a top-level key by the faulty parser. Because the description explicitly lists srcip, dstip, date, time, and tz as injectable keys, these are the specific field names an attacker would target.

Stage 3 — Payload Execution. The crafted syslog payload is sent over UDP or TCP to the Graylog syslog listener using standard syslog framing (RFC 3164 or RFC 5424). No special tooling is required beyond netcat, socat, logger, or a simple Python script. The vulnerability class is key-value injection via improper quote handling in a text-based parser — no memory corruption, no binary payload, no authentication bypass. The attack is purely at the application-logic layer.

Stage 4 — Post-Exploitation Impact. Two distinct malicious outcomes are possible:

• Field Manipulation / Log Tampering: The attacker overwrites source/destination IPs, timestamps, or timezone fields. This can distort security investigations (e.g., attributing traffic to a wrong source IP) or break log-correlation pipelines that match on these fields. For a SIEM downstream of Graylog, this can corrupt alerts and dashboards.
• Log Evasion / Message Discard: If the crafted input produces a structurally invalid message, Graylog drops the entire event. The attacker can then exfiltrate data, perform lateral movement, or execute malware while the associated FortiGate log entries are silently suppressed — defeating the purpose of security log retention.

The MITRE ATT&CK mapping is T1562.002 — Impair Defenses: Disable Security Event Logging, as the attacker manipulates or suppresses the recording of security events.

Proof of Concept Intelligence

No public proof-of-concept code, Nuclei template, or Metasploit module currently exists for CVE-2026-55841. The vendor advisory describing the flaw has been published, but exploit development has not been reported as of this writing.

Why exploitation may still be possible without a public PoC:

1. The flaw is straightforward to reproduce. The vulnerable behavior is a text-parsing issue, not a complex memory-corruption bug. A competent penetration tester can craft a test payload by experimenting with quoted values containing = and \" sequences against a live Graylog instance. The space of malicious payloads is small and discoverable through black-box fuzzing.

2. Default exposure. Many Graylog deployments accept syslog on unauthenticated UDP sockets — a fundamental protocol limitation. Firewalls rarely restrict who can send log data to a collector, making this vulnerability broadly reachable in practice even if the CVSS vector alone did not make this obvious.

3. No EDR/AV can stop this. The attack is performed over plain network protocols and never touches disk on the Graylog server. Endpoint detection tools on the Graylog host will not flag a syslog UDP packet containing unusual quote syntax. Only the syslog input logic itself is the boundary.

Resources defenders should monitor for future PoC disclosure:

• Graylog's official security advisories and GitHub Security Advisories page
• NVD page for CVE-2026-55841 for updates on CVSS scoring and references
• Exploit-db and Packet Storm for shellcode/PoC submissions
• GitHub code-search for references to GLFortiGateSyslogEvent, KV_PATTERN, or QUOTED_KV_PATTERN — early PoCs may be committed as test cases
• Public vulnerability research Twitter/X accounts and security newsletters (e.g., The Daily Swig, BleepingComputer)

Impact Assessment

Business Impact. Graylog is widely used as a centralized log management and SIEM-adjacent platform in mid-to-large enterprises, particularly in security operations centers that ingest FortiGate firewall logs. This CVE directly undermines the integrity of that data:

• Integrity of log data (CVSS I:H): An attacker can forge or modify source/destination IP addresses, timestamps, and timezone markers, corrupting downstream analytics, security monitoring dashboards, and audit trails.
• Availability of log evidence (indirect): By causing malformed messages to be discarded, the attacker can remove specific log entries. This is an integrity impact on the log stream rather than a denial-of-service (the Graylog service itself remains operational).
• Compliance risk: Organizations subject to PCI-DSS, SOX, GDPR, or NERC CIP that rely on FortiGate syslog as part of mandatory audit trails could face compliance violations if logging is proven tamperable.
• Forensic impact: During incident response, if the attacker has suppressed relevant log entries, triage and root-cause analysis are significantly degraded, potentially prolonging dwell time.

Affected Systems.

• Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2
• Graylog Forwarder versions prior to 7.3
• Any environment with a configured syslog TCP/UDP input that uses the FortiGate codec (note: the parser may be invoked for all syslog messages if the input is configured in a permissive mode)

Blast Radius.

• Network exposure: Any segment with access to the syslog listener (often the DMZ or the internal security monitoring segment).
• Downstream consumers: Elasticsearch/OpenSearch indices, alerting rules, Grafana dashboards, and any SIEM correlated with Graylog data.
• Upstream sources: Legitimate FortiGate devices whose logs can be impersonated by spoofed messages (since the parser cannot distinguish a genuine FortiGate device from an attacker from the same source address).

The CVSS subscores confirm the risk profile: no confidentiality loss, high integrity loss, and no direct availability impact — but log integrity in a security context is arguably as damaging as availability loss, since it blinds the defense systems.

Detection Guidance

Sigma Rule

title: Graylog FortiGate KV Parser Injection - CVE-2026-55841
id: 7f9e6c2a-8b4e-4f1a-9c2d-3a5b6e7f8a90
status: experimental
description: Detects crafted FortiGate syslog messages containing embedded key-value pairs with special characters that could exploit CVE-2026-55841
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55841
author: Valtersit Threat Intelligence Team
date: 2026/01/01
tags:
    - attack.t1562.002
    - cve.2026.55841
logsource:
    product: syslog
    service: fortigate
detection:
    selection_msg_quote_equals:
        msg|contains:
            - '="*="'
            - '=\"*=\"'
    selection_srcip_embedded:
        msg|contains|all:
            - '"'
            - 'srcip='
    selection_dstip_embedded:
        msg|contains|all:
            - '"'
            - 'dstip='
    selection_time_embedded:
        msg|contains|all:
            - '"'
            - 'time='
    selection_escaped_quotes:
        msg|contains: '\"='
    condition: selection_msg_quote_equals or selection_srcip_embedded or selection_dstip_embedded or selection_time_embedded or selection_escaped_quotes
falsepositives:
    - Legitimate FortiGate messages that legitimately contain quoted strings with equals signs (e.g., custom log fields)
level: high

YARA Rule

rule Graylog_CVE_2026_55841_FortiGate_KV_Injection {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects FortiGate syslog payloads with embedded key-value patterns indicative of CVE-2026-55841 exploitation"
        cve = "CVE-2026-55841"
        date = "2026-01-01"
    strings:
        $srcip = /[\"\s]srcip=\S+/ nocase
        $dstip = /[\"\s]dstip=\S+/ nocase
        $date  = /[\"\s]date=\S+/ nocase
        $time  = /[\"\s]time=\S+/ nocase
        $tz    = /[\"\s]tz=\S+/ nocase
        $eq_in_quotes = /=\S*\"[^"]*=[^"]*\"/ nocase
        $escaped_quote = /\\\"/ nocase
    condition:
        any of ($srcip, $dstip, $date, $time, $tz) and
        ($eq_in_quotes or $escaped_quote)
}

Suricata IDS Rule

alert udp any any -> $GRAYLOG_SYSLOG_SERVERS 514 (msg:"GRAYLOG CVE-2026-55841 FortiGate KV escaped quote attempt"; content:"|5c 22|"; depth:0; flow:to_server; classtype:attempted-admin; sid:20265584101; rev:1;)
alert udp any any -> $GRAYLOG_SYSLOG_SERVERS 514 (msg:"GRAYLOG CVE-2026-55841 FortiGate quoted key-value injection"; pcre:"/[\"=]\w+=(srcip|dstip|date|time|tz)=/i"; classtype:attempted-admin; sid:20265584102; rev:1;)
alert tcp any any -> $GRAYLOG_SYSLOG_SERVERS 514 (msg:"GRAYLOG CVE-2026-55841 FortiGate KV injection over TCP"; pcre:"/[\"=]\w+=(srcip|dstip|date|time|tz)=/i"; flow:to_server,established; classtype:attempted-admin; sid:20265584103; rev:1;)

Note: The above rules assume the syslog listener uses port 514. Adjust the destination port variable ($GRAYLOG_SYSLOG_SERVERS) or literal port values to match your environment.

Elastic Detection

// EQL event correlation for CVE-2026-55841 - Graylog ingestion of suspicious FortiGate messages
// Run on ECS syslog fields or Graylog input logs

sequence by host.name, source.ip
  [ syslog where message : "*srcip=*" and message : "*=*\"*" ]
  [ syslog where message : "*\\\"*srcip=*" or message : "*dstip=*\\\"*" ]

Elasticsearch query alternative (for directly searching ingested Graylog indices):

{
  "query": {
    "bool": {
      "filter": [
        { "match": { "message": "srcip=" } }
      ],
      "must_not": [
        { "match": { "message": "srcip=" } },
        { "regexp": { "message": ".*([\"=]srcip=).*" } }
      ]
    }
  }
}

A more practical EQL rule for the overwrite/discard pattern:

any where 
  /["=](srcip|dstip|date|time|tz)=/ in message and
  /\\"/ in message

Splunk SPL Query

index=graylog sourcetype=syslog
| eval suspicious = if(match(message, "[\"=](srcip|dstip|date|time|tz)="), 1, 0)
| eval escaped_quote = if(match(message, "\\\\\""), 1, 0)
| where suspicious=1 OR escaped_quote=1
| stats count by src_ip, host, message
| where count > 10
| sort - count
| table _time, src_ip, host, count, message

For real-time detection:

index=graylog sourcetype=syslog 
| search message = "*srcip=*" OR message = "*dstip=*" OR message = "*date=*" OR message = "*time=*" OR message = "*tz=*"
| regex message = "(?i)[\"=](srcip|dstip|date|time|tz)="
| eval alert = "CVE-2026-55841 potential exploit"
| table _time, src_ip, host, message, alert

Wazuh OSSEC Rule

<group name="graylog,">
  <rule id="100558" level="12">
    <if_sid>100001</if_sid>
    <match>srcip=|dstip=|date=|time=|tz=</match>
    <regex>[\"=](srcip|dstip|date|time|tz)=</regex>
    <description>Graylog CVE-2026-55841: FortiGate KV parser injection detected - embedded key-value inside quoted string</description>
    <group>graylog_cve_2026_55841,</group>
    <mitre>
      <id>T1562.002</id>
    </mitre>
  </rule>

  <rule id="100559" level="10">
    <if_sid>100001</if_sid>
    <match>\\\"=</match>
    <description>Graylog CVE-2026-55841: Escaped quote with equals sign in syslog message - potential KV injection</description>
    <group>graylog_cve_2026_55841,</group>
    <mitre>
      <id>T1562.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source as of this report's compilation). The vendor's NVD description indicates the issue is "fixed" in specific versions (Graylog Server 6.3.12, 7.0.7, 7.1.2 and Graylog Forwarder 7.3), but automated patch tracking sources have not yet confirmed these releases. Treat the vendor advisory as authoritative for planning, but validate the availability of the releases before executing upgrade timelines.

1) Immediate Mitigations (Stop-Gap)

• Network-layer restriction: Implement an allow-list firewall rule on the Graylog syslog input ports (UDP/TCP 514, 1514, etc.) that only permits traffic from legitimate, known log sources (e.g., FortiGate device management IPs, syslog relay hosts). Deny all other source addresses.
• Input-level content inspection: If a network IPS/IDS (Suricata, Snort, Palo Alto, etc.) sits in front of the Graylog receiver, deploy the Suricata rules provided above to drop (not merely alert on) syslog packets matching the malicious pattern. Note that UDP packet inspection is only effective on the first fragment; use TCP for syslog ingestion where possible.
• Disable the FortiGate codec if not required: If the Graylog instance does not specifically ingest FortiGate syslog, reconfigure the syslog input to use the generic syslog codec rather than the FortiGate-specific parser. The injection is specific to the FortiGate KV parser; removing it eliminates the attack surface.
• Rate-limit/alert on malformed syslog: Configure Graylog's own pipeline rules to flag and quarantine messages that fail standard schema validation.

2) Patch / Upgrade Steps

• Immediate: Plan an upgrade to Graylog Server 7.1.2 (highest fixed version) or the equivalent 7.0.7 / 6.3.12 for constrained environments. For Graylog Forwarder, upgrade to version 7.3 or later.
• Pre-upgrade validation: Review the Graylog release notes for the fixed versions to confirm the patch content and to identify any breaking changes in the codec behavior.
• Rollout procedure: Stage the upgrade in a non-production environment first. After upgrading, replay a set of captured malicious test messages to confirm the parser now correctly treats embedded = and \" inside quoted values as literal content. Verify that legitimate FortiGate logs still parse correctly (field extraction intact).
• Fallback: If the fixed versions are not yet obtainable (patch confidence 0/4), implement the network-layer mitigations above and re-assess within 7 days for updated patch availability.

3) Long-Term Hardening

• Syslog transport security: Migrate syslog inputs from unauthenticated UDP/TCP to TLS-enabled syslog (TCP with TLS or RELP with TLS). While TLS does not address this specific content-injection flaw, it prevents IP spoofing and helps authenticate legitimate log sources, narrowing the set of parties who can exploit the parser.
• Log source authentication: If feasible, use mutual TLS or a shared-secret framing (e.g., RELP) so that only authenticated sources can submit syslog messages.
• Input normalization: Implement a Graylog processing pipeline that validates all incoming syslog messages against a strict schema. Reject any message containing unescaped quotes in KV positions before they reach the parsing stage.
• Redundancy: Configure dual log sinks — one Graylog instance and an independent syslog collector (e.g., rsyslog to a separate file-based store) — so that even if Graylog discards a maliciously malformed message, an independent copy remains for forensic purposes.
• Monitoring: Enable out-of-the-box Graylog alerting for any syslog parsing errors or dropped messages. An anomalous spike in discarded messages is a strong indicator of active exploitation attempts.
• Threat intel feeds: Subscribe to vendor security notifications for Graylog and monitor the NVD page for CVE-2026-55841 for updates on CVSS re-scoring, new references, or confirmed in-the-wild exploitation.

References

1. NVD Entry — CVE-2026-55841: https://nvd.nist.gov/vuln/detail/CVE-2026-55841
2. Graylog Security Advisory (vendor) — Fixed in Server 6.3.12/7.0.7/7.1.2 and Forwarder 7.3 (verify on https://www.graylog.org/security-advisories or GitHub releases)
3. MITRE ATT&CK — T1562.002 Impair Defenses: Disable Security Event Logging: https://attack.mitre.org/techniques/T1562/002/
4. MITRE CWE — CWE-138 Improper Neutralization of Special Elements: https://cwe.mitre.org/data/definitions/138.html
5. Graylog GitHub Repository (affected code path reference): https://github.com/Graylog2/graylog2-server (repository; the specific commit addressing the fix should be tracked in the main branch or release tags for 7.1.2)

Threat Actor Activity / Exploitation in the Wild: As of the writing of this report, there is no known active exploitation campaign, no CISA KEV inclusion, and no reports of exploit-in-the-wild for CVE-2026-55841. The EPSS score is not yet published by FIRST.org. Defenders should treat this as a high-priority patch-and-harden issue given the trivial network accessibility and the potential for undetectable log tampering.