Vulnerability · Published Jul 27, 2026 · Assigned by Cribl
CVE-2026-56748Authenticated RCE via Symlink Following in Cribl Stream Pack Git Import
High 8.8
In plain English
A high-severity security flaw in Cribl Stream from Cribl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.9%top 39.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link in the pack's functions directory.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cribl | Cribl Stream | 0 – before 4.18.2 |
Weakness: CWE-61 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- Cribl Stream 4.18.2 Security Fixes release-notes
- Cribl Trust Portal vendor-advisory