CVE-2026-56748highCWE-61

CVE-2026-56748: falha de alta gravidade em Cribl Stream

Authenticated RCE via Symlink Following in Cribl Stream Pack Git Import

Publicada em

Seguir esta CVE+ Monitorar Cribl Stream

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.9%
Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link in the pack's functions directory.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Cribl · Cribl Stream
CVEs relacionadas — Cribl Stream

No mesmo produto, das mais perigosas para as menos.

CVE-2026-56747HIGHCode Injection in JSON Pointer Processing Component in Cribl StreamEPSS 0.7%CVE-2026-45392HIGHDOM-based XSS in Cribl StreamEPSS 0.3%