{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/rsyslog-8.1901.0-through-pre-2026-11-11/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-93404"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["rsyslog (8.1901.0 through pre-2026-11-11)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["rsyslog"],"content_html":"\u003cp\u003eAn SQL injection vulnerability (CVE-2026-93404) has been identified in the rsyslog omclickhouse output module. The vulnerability exists because the built-in ClickHouse INSERT template utilizes insufficient SQL escaping that fails to account for ClickHouse backslash escapes. An attacker who can influence the content of log messages processed by an rsyslog instance configured with the omclickhouse module can inject malicious SQL statements. This module is optional and not loaded by default.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to inject arbitrary SQL commands into the ClickHouse database. The potential impact depends on the permissions of the database user configured for the omclickhouse action.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all rsyslog configurations to determine if the omclickhouse module is loaded.\u003c/li\u003e\n\u003cli\u003eUpdate to the latest version of rsyslog that includes the fix for CVE-2026-93404.\u003c/li\u003e\n\u003cli\u003eIf an immediate update is not possible, disable the omclickhouse module if it is not business-critical.\u003c/li\u003e\n\u003cli\u003eAudit database user permissions associated with the ClickHouse connection to ensure the principle of least privilege is applied.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-11T22:07:32Z","date_published":"2026-11-11T22:07:32Z","id":"https://feed.craftedsignal.io/briefs/2026-11-rsyslog-sql-injection-cve-2026-93404/","summary":"An SQL injection vulnerability in the rsyslog omclickhouse output module allows remote attackers to execute arbitrary SQL commands by sending crafted log messages that the vulnerable module processes.","title":"rsyslog: SQL injection in omclickhouse module (CVE-2026-93404)","url":"https://feed.craftedsignal.io/briefs/2026-11-rsyslog-sql-injection-cve-2026-93404/"}],"language":"en","title":"CraftedSignal Threat Feed - Rsyslog (8.1901.0 Through Pre-2026-11-11)","version":"https://jsonfeed.org/version/1.1"}