Cribl Stream 4.18.2 Security Update Advisory Fixing CVE-2026-56747 and CVE-2026-56748

Vulnerability Overview Cribl Stream version 4.18.2 contains multiple security fixes, primarily addressing two high-priority vulnerabilities: 1. CVE-2026-56747: Affects previous versions of Cribl Stream. 2. CVE-2026-56748: Affects previous versions of Cribl Stream. Affected Scope Both CVE-2026-56747 and CVE-2026-56748 affect previous versions of Cribl Stream. Customers are strongly advised to upgrade to version v4.18.2 to remediate these vulnerabilities. Remediation Upgrade to v4.18.2: Customers should upgrade to Cribl Stream v4.18.2 as soon as possible to fix the two aforementioned high-priority vulnerabilities. Additional Security Fixes CRIBL-40408: Fixed an issue where the Outpost Listener service would fail to start when the TLS configuration specified a private key passphrase. CRIBL-41380: Fixed an issue where opening the Fleet page from the Outpost Target Version screen would display the wrong Outpost group. CRIBL-39909: Fixed an issue where Cribl HTTP Destinations might stop dequeuing events due to backpressure when Strict Ordering is disabled. CRIBL-42245: Fixed an issue where shutting down consumers could cause the persistent queued workers to enter a 100% CPU loop. CRIBL-40995: Fixed an issue where worker groups might get stuck in the "loading" state upon joining. CRIBL-41259: Fixed an issue where modifying the Event Breaker Ruleset could cause the Multiplexed Event Stream Breaker to throw an error and fall back to default link breaking. CRIBL-29894: Fixed an issue where HTTP Basic Destinations might fail to output bytes correctly when events no longer contain the field. PLAT-11929: Fixed an issue in Leader High Availability (HA) deployments where the Leader node's local Git repository branch might fork from the fault-tolerant (HA) volume repository. CRIBL-37715: Fixed an issue in the Pipeline Preview pane where fields containing dots (e.g., ) were not expanding correctly. CRIBL-40928: Fixed an issue where Cribl Cloud Worker group names contained uppercase letters when Teleport was enabled or the Worker Group Size was changed. CRIBL-41494: Fixed an issue where the Post-Processing Pipeline for downstream Destinations might skip events from Sources within Packs. CRIBL-39905: Fixed an issue where triggering a Worker process configuration reload (instead of restart) via could cause a small number of in-flight events to bypass lookup functionality. CRIBL-42269: Fixed an issue where metrics were missing for a period after an upgrade. Other Functionality Fixes CRIBL-40007: Fixed an issue where the help link for the Mask Function in the Pipeline displayed incorrectly instead of opening the documentation. AI-3994: Fixed an issue where certain AI features ignored configured custom AI provider models and instead used hardcoded default models. CRIBL-41507: Fixed an issue with empty tooltips appearing on the Outpost Group Target Version screen. SDK Changelogs Go SDK changelogs: Control plane and Management plane Python SDK changelogs: Control plane and Management plane Typescript SDK changelogs: Control plane and Management plane Summary Cribl Stream version 4.18.2 includes multiple security fixes, primarily addressing two high-priority vulnerabilities (CVE-2026-56747 and CVE-2026-56748). Customers should upgrade to v4.18.2 as soon as possible to remediate these vulnerabilities. Additionally, this version includes various other security and functionality fixes to enhance system stability and security.

Goal Reached Thanks to every supporter — we hit 100%!

Cribl Stream 4.18.2 Security Update Advisory Fixing CVE-2026-56747 and CVE-2026-56748