Read the docs
TI-2024-35177 Aliases CVE-2024-52506GHSA-vggm-3478-vm5m

Graylog can leak other users' reports via concurrent PDF report rendering

Priority LOW 32CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included in Graylog 6.1.0 & 6.1.1, is vulnerable to information leakage triggered by multiple concurrent report rendering requests from authorized users. When multiple report renderings are requested at the same start time, the headless browser instance used to render the PDF will be reused. Depending on the timing, either a check for the browser instance "freshness" hits, resulting in an error instead of the report being returned, or one of the concurrent report rendering requests "wins" and this report is returned for all report rendering requests that do not return an error. This might lead to one user getting the report of a different user, potentially leaking indexed log messages or aggregated data that this user normally has no access to. This problem is fixed in Graylog 6.1.2. There is no known workaround besides disabling the reporting functionality.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00632 50th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed graylog2-server (Graylog2): 6.1.2org.graylog:graylog-parent (Maven): 6.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Graylog2graylog2-server6.1.0 to before 6.1.26.1.2Patch availableCNA
—org.graylog:graylog-parent (Maven)6.1.0 to before 6.1.26.1.2Patch availableGHSA-vggm-3478-vm5m
  • graylog2-server VendorGraylog2 Affected 6.1.0 to before 6.1.2 Fixed in 6.1.2 Patch available CNA
  • org.graylog:graylog-parent (Maven) Vendor— Affected 6.1.0 to before 6.1.2 Fixed in 6.1.2 Patch available GHSA-vggm-3478-vm5m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:graylog:graylog:*:*:*:*:*:*:*:*6.1.0 to before 6.1.2VulnerableGraylog2
  • cpe:2.3:a:graylog:graylog:*:*:*:*:*:*:*:* Versions 6.1.0 to before 6.1.2 Vulnerable ·Graylog2

Remediation

  • Fix · CNA graylog2-server (Graylog2) Fixed in 6.1.2
  • Fix · GHSA-vggm-3478-vm5m org.graylog:graylog-parent (Maven) Fixed in 6.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-52506
  2. 2026-10-03 Alias added: GHSA-vggm-3478-vm5m
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Exploit 2

Patch 1

Advisory 1

Other 1

  • TI-2024-16341 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request CVSS 3.1HIGH 8.8
  • TI-2023-21671 Insecure source port usage for DNS queries in Graylog CVSS 3.1MEDIUM 5.3
  • TI-2026-01133 Incorrect management of session invalidation vulnerability in Graylog Web Interface CVSS 4.0CRITICAL 9.3
  • TI-2023-21667 User session is still usable after logout in graylog2-server CVSS 3.1LOW 3.1
  • TI-2021-15624 A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate… CVSS 3.1CRITICAL 9.8
  • TI-2021-15623 A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to… CVSS 3.1CRITICAL 9.8
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences