The optional imdtls input module does not enforce tls.permittedpeer after a successful DTLS handshake when configured with tls.authmode="name" or tls.authmode="fingerprint".

After the handshake succeeds, imdtls performs the additional permitted-peer identity check. If that check fails, the module logs a warning but leaves the DTLS session active. The session is subsequently read and received records are passed to the configured ruleset.

A remote peer whose certificate is accepted by the listener's configured CA, but whose name or fingerprint is not listed in tls.permittedpeer, can inject chosen syslog records into the configured input stream.

The issue is limited to integrity of that input stream. It does not provide access to stored logs, modification or deletion of existing records, confidentiality loss, memory corruption, or code execution.