Critical rsyslog Flaws Let Remote Log Traffic Trigger Code Execution on openSUSE Leap 16
openSUSE has published security update openSUSE-SU-2026:22184-1, rated critical by the vendor, which resolves four vulnerabilities and nine bug fixes in rsyslog, the system logging daemon that underpins log collection on most Linux estates. The most severe issue is CVE-2026-92709, carrying a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.2, in which the omfile output module's dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, a condition the advisory states can lead to arbitrary code execution. Alongside it are CVE-2026-61548 (CVSS 8.1), a stack overwrite reachable through crafted RFC 5424 messages passed to the mmpstrucdata module, CVE-2026-78002 (CVSS 7.5), a heap buffer overflow in the RainerScript replace() function, and CVE-2026-19654 (CVSS 7.5 v3.1, 8.2 v4.0), a remote denial-of-service condition in the imptcp regex-framing logic. The affected product is openSUSE Leap 16.0, and the fix arrives as part of an upgrade to rsyslog 8.2608.0.
The advisory describes each flaw at the level of the component that fails rather than publishing a full exploitation chain. For CVE-2026-19654, the upstream change log records the fix as guarding the regex framing match at line start in imptcp, indicating the condition is reached through message framing on a TCP listener that accepts remote log traffic. CVE-2026-61548 is triggered by crafted RFC 5424 syslog messages processed by mmpstrucdata, meaning the hostile input is the log record itself rather than an administrative interface. CVE-2026-78002 and the related non-CVE length wrap tracked as bsc#1285036 both sit in RainerScript's replace() string handling, which is invoked by site-written rulesets operating on message content, and the upstream fix is listed as hardening empty string replacement in stringbuf. For CVE-2026-92709, the corresponding upstream work is recorded as hardening dynafile default containment and controlling symlink following in omfile, together with rejecting symlinked persisted segments in the disk queue, which points to attacker-influenced message properties steering the file path that rsyslog writes to. All four reach the daemon through data it is designed to ingest, which is what makes a logging service an unusually exposed parser.
The strategic weight here comes from where rsyslog sits. Central log collectors accept connections from large numbers of hosts, frequently across network segments, and the daemon commonly runs with elevated privileges and writes to directories that other tooling trusts. A path-handling weakness that ends in arbitrary code execution therefore lands on the one host that aggregates evidence from everything else, and an attacker who reaches it gains both a foothold and the ability to influence the record of their own activity. The denial-of-service condition in imptcp is quieter but no less consequential, because a collector that stops accepting connections produces a silent gap in monitoring rather than an obvious outage. On current exploitation status, none of the four CVEs has confirmed in-the-wild activity, and FIRST EPSS places the thirty-day exploitation probability at 0.6 percent for CVE-2026-19654, 0.9 percent for CVE-2026-61548, 1.1 percent for CVE-2026-78002 and 0.3 percent for CVE-2026-92709. A fixed build for openSUSE Leap 16.0 is already published, so the operative variable is exposure: a collector with an imptcp or imtcp listener reachable from untrusted networks sits in a materially different risk band from a host that only writes local logs, and the former is the population where the unauthenticated network attack vector described in the advisory actually applies.
Attack Surface
Server OS, Infrastructure, System Management Service
Tactics
Initial Access, Execution, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1499.004 – Application or System Exploitation
- T1059 – Command and Scripting Interpreter
- T1565.001 – Stored Data Manipulation
SuperPRO's Threat Countermeasures Procedures
- Install the openSUSE Leap 16.0 update from advisory openSUSE-SU-2026:22184-1, which ships rsyslog 8.2608.0, using zypper ref followed by zypper up rsyslog, then confirm with rsyslogd -v that the running build reports 8.2608.0.
- Treat central log collectors and any host with an imptcp or imtcp listener reachable from untrusted networks as the first patching wave and complete them within 24 to 72 hours; hosts that only write local files via omfile with static paths can follow the normal maintenance window, since CVE-2026-19654 and CVE-2026-61548 both require inbound remote log traffic.
- Audit rsyslog.conf and /etc/rsyslog.d/*.conf for omfile actions whose dynaFile template builds a path from message-derived properties such as %HOSTNAME%, %programname%, %syslogtag% or %$!…% JSON fields, and replace them with sanitised or fixed path components until 8.2608.0 is in place, as CVE-2026-92709 stems from untrusted input used as a path component.
- Unload or comment out module(load="mmpstrucdata") on collectors that do not need RFC 5424 structured-data parsing, removing the parser that CVE-2026-61548 reaches via crafted messages, and likewise review rulesets calling the RainerScript replace() function on raw message fields (CVE-2026-78002 and the length-wrap defect bsc#1285036).
- Restrict inbound syslog on TCP/514 and any custom imptcp or imtcp ports to known sender subnets with firewalld rich rules, for example firewall-cmd –permanent –add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=514 protocol=tcp accept', and drop the port from all other sources.
- Alert on rsyslog availability loss as a potential CVE-2026-19654 symptom: monitor systemd for repeated rsyslog.service restarts or Result=signal entries, and raise a ticket on any collector whose inbound message rate drops to zero while source hosts remain online.
- Enable file integrity monitoring on /var/log and the rsyslog spool directory and alert on log files created outside the expected naming scheme or on symlinks appearing in the work directory, since the 8.2608.0 fixes include controlling symlink following in omfile and rejecting symlinked persisted disk-queue segments.
