Rsyslog (8.1901.0 Through Pre-2026-11-11) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/rsyslog-8.1901.0-through-pre-2026-11-11/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 22:07:32 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgrsyslog: SQL injection in omclickhouse module (CVE-2026-93404)https://feed.craftedsignal.io/briefs/2026-11-rsyslog-sql-injection-cve-2026-93404/Wed, 11 Nov 2026 22:07:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-rsyslog-sql-injection-cve-2026-93404/An SQL injection vulnerability in the rsyslog omclickhouse output module allows remote attackers to execute arbitrary SQL commands by sending crafted log messages that the vulnerable module processes.An SQL injection vulnerability (CVE-2026-93404) has been identified in the rsyslog omclickhouse output module. The vulnerability exists because the built-in ClickHouse INSERT template utilizes insufficient SQL escaping that fails to account for ClickHouse backslash escapes. An attacker who can influence the content of log messages processed by an rsyslog instance configured with the omclickhouse module can inject malicious SQL statements. This module is optional and not loaded by default.

Impact

Successful exploitation allows an attacker to inject arbitrary SQL commands into the ClickHouse database. The potential impact depends on the permissions of the database user configured for the omclickhouse action.

Recommendation

  1. Inventory all rsyslog configurations to determine if the omclickhouse module is loaded.
  2. Update to the latest version of rsyslog that includes the fix for CVE-2026-93404.
  3. If an immediate update is not possible, disable the omclickhouse module if it is not business-critical.
  4. Audit database user permissions associated with the ClickHouse connection to ensure the principle of least privilege is applied.
]]>mediumadvisory