CVE-2026-93402

A flaw was found in rsyslog. When using the imdtls input module configured for name or fingerprint authentication, permitted-peer identity checks are not enforced after a successful DTLS handshake. A remote attacker possessing a valid certificate signed by the listener's trusted Certificate Authority could bypass peer restrictions and inject unauthorized syslog records into the input stream.

This vulnerability only affects rsyslog instances explicitly configured with the optional imdtls module using tls.authmode="name" or tls.authmode="fingerprint" together with tls.permittedpeer. Standard DTLS certificate-chain verification remains effective, meaning an attacker must possess a certificate trusted by the listener's configured CA; clients with untrusted or self-signed certificates cannot exploit this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.