CVE-2026-39879

highCVSS 7.1covered by 2 sourcesfirst seen 2026-07-14

Due to a missing sanitization call in afsql_dd_run_query, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8

CSIRTS triage

What: There is a SQL injection vulnerability in the syslog-ng SQL destination driver.
Who is affected: Deployments of syslog-ng that utilize the SQL destination driver are affected.
Urgency: Remediation is urgent due to the high severity and potential for exploitation.
Action: Apply the patch for CVE-2026-39879.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-39879

Get an email if CVE-2026-39879 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.

Advisory coverage (2)

highCVE-2026-39879: Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/sysl…nvd · 2026-07-20
highCVE-2026-39879: SQL injection in syslog-ng SQL destionation drivermsrc · 2026-07-14

External references

NVD record for CVE-2026-39879

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-39879 status](https://www.csirts.com/badge/CVE-2026-39879)](https://www.csirts.com/cve/CVE-2026-39879)