Skip to content
OpenAdvisories
Medium WID-SEC-2026-3088 3 CVEs

Graylog: Mehrere Schwachstellen

Published Aug 30, 2026 · Updated Aug 30, 2026 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Graylog ausnutzen, um Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand herbeizuführen.

Product

GrayLog open source ist eine Log-Management-Lösung.

Vulnerabilities 3

  • High 7.5
    CVE-2026-55841

    Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message

    Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslo…

    Graylog2 graylog2-server org.graylog2:graylog2-server Maven
  • Medium 5.3
    CVE-2026-55867

    Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

    Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implemented by UsersResource.revokeToken() in graylog2-server/src/main/java/org/graylog2/rest/resources/users…

    Graylog2 graylog2-server org.graylog2:graylog2-server Maven
  • Medium 5.0
    CVE-2026-55425

    Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields

    Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows …

    Graylog2 graylog2-server org.graylog2:graylog2-server Maven

Revision history

  1. #1

    Initiale Fassung

References