CVE-2026-93402

{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Claude (Anthropic) and David Korczynski (Ada Logics) for reporting this issue.", "bugzilla": {"description": "rsyslog: rsyslog: imdtls permitted-peer authorization bypass", "id": "2537761", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537761"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-287", "details": ["A flaw was found in rsyslog. When using the imdtls input module configured for name or fingerprint authentication, permitted-peer identity checks are not enforced after a successful DTLS handshake. A remote attacker possessing a valid certificate signed by the listener's trusted Certificate Authority could bypass peer restrictions and inject unauthorized syslog records into the input stream."], "name": "CVE-2026-93402", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "rsyslog", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "rsyslog", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "rsyslog7", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "rsyslog", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "rsyslog", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "rsyslog", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-22T16:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93402\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93402"], "statement": "This vulnerability only affects rsyslog instances explicitly configured with the optional imdtls module using tls.authmode=\"name\" or tls.authmode=\"fingerprint\" together with tls.permittedpeer. Standard DTLS certificate-chain verification remains effective, meaning an attacker must possess a certificate trusted by the listener's configured CA; clients with untrusted or self-signed certificates cannot exploit this issue.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "rsyslog", "vendor": "rsyslog"}], "created": "2026-09-29T17:15:08.098219+00:00", "updated": "2026-09-30T02:00:15.529967+00:00", "vendors": ["rsyslog", "rsyslog$PRODUCT$rsyslog"]}