graylog2-server vulnerabilities

Latest graylog2-server CVEs

Newest publication first

1. CVE-2026-69190 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

   Published 2026-09-21

   Medium·CVSS 6.3 EPSS 0.42%

   Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbi...

2. CVE-2026-92789 Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect

   Published 2026-09-16

   High·CVSS 7.1 EPSS 0.42%

   Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup table or event notification permissions can craft allowlisted endpoints that redirect to internal services, ena...

3. CVE-2026-55867 Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

   Published 2026-08-28

   Medium·CVSS 5.3 EPSS 0.57%

   Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implemented by UsersResource.revokeToken() in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java c...

4. CVE-2026-55841 Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message

   Published 2026-08-28

   High·CVSS 7.5 EPSS 0.63%

   Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and grayl...

5. CVE-2026-55425 Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields

   Published 2026-08-28

   Medium·CVSS 5.0 EPSS 0.41%

   Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user...

6. CVE-2025-53106 Graylog vulnerable to privilege escalation through API tokens

   Published 2025-07-02

   High·CVSS 8.8 EPSS 0.61%

   Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user know...

7. CVE-2025-46827 Graylog Allows Session Takeover via Insufficient HTML Sanitization

   Published 2025-05-07

   Medium·CVSS 5.4 EPSS 0.29%

   Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user a...

8. CVE-2025-30373 Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value

   Published 2025-04-07

   Medium·CVSS 5.3 EPSS 0.34%

   Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value...

9. CVE-2024-52506 Graylog can leak other users' reports via concurrent PDF report rendering

   Published 2024-11-18

   High·CVSS 7.1 EPSS 0.63%

   Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionali...

10. CVE-2024-24824 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request

    Published 2024-02-07

    High·CVSS 8.8 EPSS 34.7%

    Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the /api/system/cluster_config/ endpoint. Graylog's cluster config system uses fully...

11. CVE-2024-24823 graylog2-server Session Fixation vulnerability through cookie injection

    Published 2024-02-07

    Medium·CVSS 4.4 EPSS 0.41%

    Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session cookie would re-use that session id, even if for different user credentials. In this case, the pre-existing session coul...

12. CVE-2023-41045 Insecure source port usage for DNS queries in Graylog

    Published 2023-08-31

    Medium·CVSS 5.3 EPSS 0.36%

    Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single socket for outgoing DNS queries and while that socket is bound to a random port number it is never changed again. This goes against recomme...

13. CVE-2023-41044 Partial path traversal vulnerability in Support Bundle feature of Graylog

    Published 2023-08-31

    Low·CVSS 3.8 EPSS 0.70%

    Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's Support Bundle feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource. Graylog's Support Bundle feature allows an attacker with...

14. CVE-2023-41041 User session is still usable after logout in graylog2-server

    Published 2023-08-30

    Low·CVSS 3.1 EPSS 0.48%

    Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Each node maintains an in-memory cache of user sessions. U...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.