Bug 2569362 (CVE-2026-93404) - CVE-2026-93404 rsyslog: rsyslog omclickhouse SQL injection
Summary: CVE-2026-93404 rsyslog: rsyslog omclickhouse SQL injection
Keywords:
Status: NEW
Alias: CVE-2026-93404
Deadline: 2026-11-11
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2572085
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-10 09:23 UTC by OSIDB Bzimport
Modified: 2026-11-12 05:19 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-10 09:23:07 UTC 
The built-in ClickHouse INSERT template used SQL escaping that did not
account for ClickHouse backslash escapes. A sender able to submit a log
message routed to an affected action could alter the SQL sent to ClickHouse.
Affected deployments use the built-in template or custom INSERT templates
with option.stdsql="on". The issue was introduced in rsyslog 8.1901.0;
affected builds precede the planned 2026-11-11 daily stable fix. In
8.1901.0 the built-in template lacked a required SQL mode, while custom
stdSQL templates were exposed. Later releases used the vulnerable built-in
stdSQL template
Note You need to log in before you can comment on or make changes to this bug.