org.graylog2/graylog2-server vulnerabilities

Latest org.graylog2/graylog2-server CVEs

Newest publication first

1. CVE-2026-69190 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

   Published 2026-09-21

   Medium·CVSS 6.3 EPSS 0.42%

   Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbi...

2. CVE-2026-55867 Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

   Published 2026-08-28

   Medium·CVSS 5.3 EPSS 0.57%

   Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implemented by UsersResource.revokeToken() in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java c...

3. CVE-2026-55841 Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message

   Published 2026-08-28

   High·CVSS 7.5 EPSS 0.63%

   Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and grayl...

4. CVE-2026-55425 Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields

   Published 2026-08-28

   Medium·CVSS 5.0 EPSS 0.41%

   Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user...

5. CVE-2025-53106 Graylog vulnerable to privilege escalation through API tokens

   Published 2025-07-02

   High·CVSS 8.8 EPSS 0.61%

   Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user know...

6. CVE-2025-46827 Graylog Allows Session Takeover via Insufficient HTML Sanitization

   Published 2025-05-07

   Medium·CVSS 5.4 EPSS 0.29%

   Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user a...

7. GHSA-q9q2-3ppx-mwqf Graylog Allows Stored Cross-Site Scripting via Files Plugin and API Browser

   Published 2025-05-07

   High·CVSS 7.3

   Impact Two minor vulnerabilities were identified in the Graylog2 enterprise server, which can be combined to carry out a stored cross-site scripting attack. An attacker with the permission FILES_CREATE can exploit these vulnerabilities to upload arbitrary Javascript code to the G...

8. CVE-2025-30373 Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value

   Published 2025-04-07

   Medium·CVSS 5.3 EPSS 0.34%

   Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value...

9. CVE-2024-24824 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request

   Published 2024-02-07

   High·CVSS 8.8 EPSS 34.7%

   Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the /api/system/cluster_config/ endpoint. Graylog's cluster config system uses fully...

10. CVE-2024-24823 graylog2-server Session Fixation vulnerability through cookie injection

    Published 2024-02-07

    Medium·CVSS 4.4 EPSS 0.41%

    Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session cookie would re-use that session id, even if for different user credentials. In this case, the pre-existing session coul...

11. CVE-2023-41045 Insecure source port usage for DNS queries in Graylog

    Published 2023-08-31

    Medium·CVSS 5.3 EPSS 0.36%

    Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single socket for outgoing DNS queries and while that socket is bound to a random port number it is never changed again. This goes against recomme...

12. CVE-2023-41044 Partial path traversal vulnerability in Support Bundle feature of Graylog

    Published 2023-08-31

    Low·CVSS 3.8 EPSS 0.70%

    Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's Support Bundle feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource. Graylog's Support Bundle feature allows an attacker with...

13. CVE-2023-41041 User session is still usable after logout in graylog2-server

    Published 2023-08-30

    Low·CVSS 3.1 EPSS 0.48%

    Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Each node maintains an in-memory cache of user sessions. U...

14. CVE-2018-14380 Cross-site Scripting in Graylog Server

    Published 2018-07-18

    Medium·CVSS 6.1 EPSS 0.98%

    In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts.

15. CVE-2018-11651 Cross-site Scripting in Graylog

    Published 2018-06-01

    Medium·CVSS 6.1 EPSS 0.78%

    Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx.

16. CVE-2018-11650 Cross-site Scripting in Graylog Server

    Published 2018-06-01

    Medium·CVSS 6.1 EPSS 0.82%

    Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.