CVE-2026-56748

HIGH

Authenticated RCE via Symlink Following in Cribl Stream Pack Git Import

Title source: cna
STIX 2.1

Description

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link in the pack's functions directory.

References (2)

Core 2
Core References
Release Notes release-notes
Cribl Stream 4.18.2 Security Fixes
https://docs.cribl.io/stream/release-notes/release-v4182/#security-fixes
Vendor Advisory vendor-advisory
Cribl Trust Portal
https://trust.cribl.io/notifications

Scores

CVSS v3 8.8
EPSS 0.0057
EPSS Percentile 43.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-61
Status published
Products (1)
Cribl/Cribl Stream < 4.18.2
Published Jul 27, 2026
Tracked Since Jul 28, 2026