Medium WID-SEC-2026-3421 1 CVE

Graylog: Schwachstelle ermöglicht Offenlegung von Informationen

Published Sep 16, 2026 · Updated Sep 16, 2026 · de-DE

Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Graylog ausnutzen, um Informationen offenzulegen.

Product

GrayLog open source ist eine Log-Management-Lösung.

Vulnerabilities 1

Medium 6.5

CVE-2026-92789

Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect

Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup table or event notification permissions can craft allowlisted endpoints that redirect to i…

Graylog2 graylog2-server

Sep 16, 2026

Revision history

2026-09-16 #1
Initiale Fassung

References

GitHub Advisory Database vom 2026-09-16
https://github.com/advisories/GHSA-PGWR-3C66-C473
Graylog Issue vom 2026-09-16
https://github.com/Graylog2/graylog2-server/issues/26591