rsyslog: SQL injection in omclickhouse module (CVE-2026-93404)
An SQL injection vulnerability in the rsyslog omclickhouse output module allows remote attackers to execute arbitrary SQL commands by sending crafted log messages that the vulnerable module processes.
CVE search metadata
CVE search record: CVE-2026-93404. KEV: no. Product: rsyslog (8.1901.0 through pre-2026-11-11). Brief: rsyslog: SQL injection in omclickhouse module (CVE-2026-93404). Brief link: https://feed.craftedsignal.io/briefs/2026-11-rsyslog-sql-injection-cve-2026-93404/
Triage facts
Revision 1- Applicability
- rsyslog (8.1901.0 through pre-2026-11-11)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 11, 22:07 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
An SQL injection vulnerability (CVE-2026-93404) has been identified in the rsyslog omclickhouse output module. The vulnerability exists because the built-in ClickHouse INSERT template utilizes insufficient SQL escaping that fails to account for ClickHouse backslash escapes. An attacker who can influence the content of log messages processed by an rsyslog instance configured with the omclickhouse module can inject malicious SQL statements. This module is optional and not loaded by default.
Impact
Successful exploitation allows an attacker to inject arbitrary SQL commands into the ClickHouse database. The potential impact depends on the permissions of the database user configured for the omclickhouse action.
Recommendation
- Inventory all rsyslog configurations to determine if the omclickhouse module is loaded.
- Update to the latest version of rsyslog that includes the fix for CVE-2026-93404.
- If an immediate update is not possible, disable the omclickhouse module if it is not business-critical.
- Audit database user permissions associated with the ClickHouse connection to ensure the principle of least privilege is applied.
Immediate actions
Inventory all rsyslog configurations to identify active usage of the omclickhouse module.
Update rsyslog to the latest stable release to remediate CVE-2026-93404.
Threat Hunt
Investigate logs for unusual characters in log fields destined for ClickHouse, specifically sequences involving backslashes used in attempts to break out of SQL injection contexts.
Data: ClickHouse query logs, rsyslog input log samples
Mitigations
Disable the omclickhouse module in rsyslog.conf or related configuration files if it is not strictly required.
CVE-2026-93404