Description

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java mishandles field-like text inside quoted values. GLFortiGateSyslogEvent.getFields() uses KV_PATTERN and QUOTED_KV_PATTERN, while SyslogCodec.parse() invokes the FortiGateSyslogEvent parser; crafted values containing = or backslash-escaped quotes can cause embedded keys such as srcip, dstip, date, time, and tz to remove or overwrite original top-level fields or produce an invalid message that Graylog discards. An unauthenticated network sender who can submit syslog messages can therefore manipulate security-log fields or evade logging to obscure malicious activity. This issue is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T23:17:07.840Z",
  "pubdate": "2026-08-28T23:17:07.840Z",
  "executiveSummary": "A vulnerability exists in the FortiGate key-value syslog parser within Graylog Server and Graylog Forwarder, classified as a field injection and parsing manipulation flaw.\nThe vulnerability allows an unauthenticated remote attacker to craft malicious syslog messages that cause the parser to incorrectly handle embedded field-like text within quoted values.\nBy submitting specially crafted payloads containing specific delimiters (e.g., '=' or backslash-escaped quotes), an attacker can trigger field overwrites or field removal.\nThis manipulation results in the corruption of critical security-relevant metadata, such as source IP (srcip), destination IP (dstip), date, and time.\nThe primary risk implication is the potential for log evasion, where malicious activity is obscured by overwriting security logs, thereby compromising the integrity of the logging pipeline.\nAffected products include Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2, and Graylog Forwarder version prior to 7.3.\nExploitation requires the ability to send syslog messages to the Graylog instance, typically over a network path accessible by the attacker.",
  "technicalDetails": "The vulnerability originates in the parsing logic for FortiGate syslog messages, specifically within 'graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java' and 'graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java'.\nThe root cause is the inadequate handling of nested key-value structures when embedded within quoted values. The 'GLFortiGateSyslogEvent.getFields()' method relies on 'KV_PATTERN' and 'QUOTED_KV_PATTERN' regular expressions to tokenize incoming log strings. These regex patterns fail to correctly distinguish between legitimate top-level key-value pairs and key-value pairs masquerading as data within a quoted string.\nWhen the 'SyslogCodec.parse()' method invokes the FortiGateSyslogEvent parser, it processes the log entry sequentially. If an attacker injects a string containing '=' or backslash-escaped quotes, the parser's logic can be subverted into interpreting the attacker-supplied text as an additional set of fields. This interpretation leads to the parser incorrectly updating the internal message object's field map.\nThe exploitation flow is as follows: 1) An attacker crafts a syslog message where a legitimate field value contains a substring that mirrors the structure of a key-value pair. 2) The payload is transmitted to the Graylog input via an unauthenticated network connection. 3) The 'SyslogCodec' passes this payload to the 'GLFortiGateSyslogEvent' parser. 4) The parser's regex routines treat the injected content as valid, top-level fields due to improper escaping or boundary enforcement. 5) The injected fields (such as 'srcip' or 'dstip') are inserted into the message metadata, effectively overwriting original, valid fields extracted earlier in the parsing process.\nAlternatively, the injection can cause the parser to generate an invalid message structure, forcing Graylog to discard the log entry entirely. This behavior enables a 'log hiding' or 'evasion' scenario, where specific security-related logs are rendered unsearchable or deleted from the log management platform.\nThis vulnerability is particularly severe because it does not require authentication to the Graylog interface, only network reachability to the input port receiving FortiGate syslogs. Successful exploitation allows for the systematic manipulation of audit trails, which could be used to cover the tracks of unauthorized system access or lateral movement within an infrastructure that relies on Graylog for centralized security monitoring."
}