CVE-2026-93404

{}

{}

{}

{"bugzilla": {"description": "rsyslog: rsyslog omclickhouse SQL injection", "id": "2569362", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569362"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-89", "details": ["A flaw was found in rsyslog. The built-in ClickHouse output templates fail to properly escape backslash characters when formatting Structured Query Language (SQL) queries. An attacker capable of submitting crafted log messages routed to an affected ClickHouse action can exploit this issue to alter executed SQL commands, potentially leading to unauthorized database modification or information disclosure."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, disable the ClickHouse output module or comment out all action directives utilizing 'omclickhouse' within /etc/rsyslog.conf and /etc/rsyslog.d/.\nAfter modifying the configuration, restart the rsyslog service:\nsystemctl restart rsyslog\nWarning: Restarting the rsyslog service briefly interrupts log processing, and disabling the omclickhouse action stops forwarding log records to the ClickHouse database.\nIf forwarding cannot be disabled, restrict remote access to rsyslog ingestion ports (such as UDP/TCP port 514) to trusted network hosts using firewall rules to prevent unauthorized message submission."}, "name": "CVE-2026-93404", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rsyslog", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Affected", "package_name": "rsyslog", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Affected", "package_name": "rsyslog7", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Affected", "package_name": "rsyslog", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "rsyslog", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "rhel9/rsyslog", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "rsyslog", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-11-11T12:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93404\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93404"], "statement": "Red Hat has rated this vulnerability as Important because a sender capable of submitting crafted log events can inject arbitrary SQL commands into the backend database, potentially compromising data integrity and confidentiality. The flaw specifically affects instances configured with the ClickHouse output module (omclickhouse), which is not active in default rsyslog installations and must be explicitly configured in deployment rulesets. Deployments that do not forward log messages to ClickHouse or that only ingest logs from trusted local sources have significantly reduced exposure.", "threat_severity": "Important"}

{}