Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The built-in ClickHouse INSERT template used SQL escaping that did not
account for ClickHouse backslash escapes. A sender able to submit a log
message routed to an affected action could alter the SQL sent to ClickHouse.
Affected deployments use the built-in template or custom INSERT templates
with option.stdsql="on". The issue was introduced in rsyslog 8.1901.0;
affected builds precede the planned 2026-11-11 daily stable fix. In
8.1901.0 the built-in template lacked a required SQL mode, while custom
stdSQL templates were exposed. Later releases used the vulnerable built-in
stdSQL template