Cyber ·
CVE-2026-93404: SQL injection in the rsyslog omclickhouse module
Security advisory on a SQL injection in the optional rsyslog omclickhouse module, which is not loaded by default. The built-in ClickHouse INSERT template used SQL escaping that ignored ClickHouse backslash escapes.
According to the oss-sec feed content, published by Rainer Gerhards on 11 November 2026, a SQL injection flaw affects rsyslog deployments that use the optional omclickhouse output module. The module is not loaded by default, so exposure depends on whether an installation has enabled it. The assigned identifier is CVE-2026-93404. The official advisory is on the rsyslog project security advisories page on GitHub, identified as GHSA-8rx7-ww92-p4vr.
The stated cause: the built-in ClickHouse INSERT template used SQL escaping that did not account for ClickHouse backslash escapes. According to the source, a sender able to send a log message forwarded to an affected action could alter the SQL sent to the database. The text received is truncated, so details such as affected and fixed versions do not appear here.
To verify, consult the original advisory in the rsyslog repository and check the affected and fixed version list before drawing conclusions. This material is not a Rota Nacional usage tutorial. Rota Nacional does not host rsyslog or process these logs. If your organization uses the module, update rsyslog as the advisory directs and disable omclickhouse when it is not needed.
Original source: CVE-2026-93404: injeção de SQL no omclickhouse do rsyslog