Bug 2569362 (CVE-2026-93404)

Summary:	CVE-2026-93404 rsyslog: rsyslog omclickhouse SQL injection
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in rsyslog. The built-in ClickHouse output templates fail to properly escape backslash characters when formatting Structured Query Language (SQL) queries. An attacker capable of submitting crafted log messages routed to an affected ClickHouse action can exploit this issue to alter executed SQL commands, potentially leading to unauthorized database modification or information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2572085
Bug Blocks:
Deadline:	2026-11-11

Description OSIDB Bzimport 2026-11-10 09:23:07 UTC

The built-in ClickHouse INSERT template used SQL escaping that did not
account for ClickHouse backslash escapes. A sender able to submit a log
message routed to an affected action could alter the SQL sent to ClickHouse.
Affected deployments use the built-in template or custom INSERT templates
with option.stdsql="on". The issue was introduced in rsyslog 8.1901.0;
affected builds precede the planned 2026-11-11 daily stable fix. In
8.1901.0 the built-in template lacked a required SQL mode, while custom
stdSQL templates were exposed. Later releases used the vulnerable built-in
stdSQL template