Skip to content
OpenAdvisories
High WID-SEC-2026-0458 7 CVEs

Graylog: Mehrere Schwachstellen

Published Feb 18, 2026 · Updated Feb 18, 2026 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Graylog ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um einen Cross-Site Scripting Angriff durchzuführen.

Product

GrayLog open source ist eine Log-Management-Lösung.

Vulnerabilities 7

  • Critical 9.3
    CVE-2026-1435

    Incorrect management of session invalidation vulnerability in Graylog Web Interface

    Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. The application generates a new 'sessionId' each time a user authenticates, but does not invalidate p…

    Graylog Graylog Web Interface
  • High 7.1
    CVE-2026-1436

    Improper Access Control (IDOR) vulnerability in Graylog Web Interface

    Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user's profiles without proper authorization checks. Exploiting this vulnerability allows valid users …

    Graylog Graylog Web Interface
  • Medium 5.3
    CVE-2026-1437

    Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

    Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applyin…

    Graylog Graylog Web Interface
  • Medium 5.3
    CVE-2026-1438

    Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

    Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applyin…

    Graylog Graylog Web Interface
  • Medium 5.3
    CVE-2026-1439

    Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

    Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applyin…

    Graylog Graylog Web Interface
  • Medium 5.3
    CVE-2026-1440

    Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

    Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applyin…

    Graylog Graylog Web Interface
  • Medium 5.3
    CVE-2026-1441

    Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

    Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applyin…

    Graylog Graylog Web Interface

Revision history

  1. #1

    Initiale Fassung

References