TI-2025-21679 Aliases CVE-2025-30373 GHSA-q7g5-jq6p-6wvx

Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value

LOW 29CWE-285Published 2025-04-07 · Updated 2025-04-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless. To mitigate the vulnerability, disable http-based inputs and allow only authenticated pull-based inputs. This vulnerability is fixed in 6.1.9.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00336 27th percentileScored 2026-11-07

Fix Fixed graylog2-server (Graylog2): 6.1.9org.graylog2:graylog2-server (Maven): 6.1.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Graylog2	graylog2-server	6.1.0 to before 6.1.9	6.1.9	Patch available	CNA
—	org.graylog2:graylog2-server (Maven)	6.1.0 to before 6.1.9	6.1.9	Patch available	GHSA-q7g5-jq6p-6wvx

graylog2-server VendorGraylog2 Affected 6.1.0 to before 6.1.9 Fixed in 6.1.9 Patch available CNA
org.graylog2:graylog2-server (Maven) Vendor— Affected 6.1.0 to before 6.1.9 Fixed in 6.1.9 Patch available GHSA-q7g5-jq6p-6wvx

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:graylog:graylog::::::::	6.1.0 to before 6.1.9	Vulnerable	Graylog2

cpe:2.3:a:graylog:graylog:*:*:*:*:*:*:*:* Versions 6.1.0 to before 6.1.9 Vulnerable ·Graylog2

Remediation

Fix · CNA graylog2-server (Graylog2) Fixed in 6.1.9
Fix · GHSA-q7g5-jq6p-6wvx org.graylog2:graylog2-server (Maven) Fixed in 6.1.9 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-30373
2026-10-03 Alias added: GHSA-q7g5-jq6p-6wvx

References

Patch 1

https://github.com/Graylog2/graylog2-server/commit/31bc13d3cd6f550ec83473d0f8666cd3ebf50f10

Advisory 2

Other 1

https://github.com/Graylog2/graylog2-server

TI-2024-16341 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request CVSS 3.1HIGH 8.8
TI-2023-21671 Insecure source port usage for DNS queries in Graylog CVSS 3.1MEDIUM 5.3
TI-2026-01133 Incorrect management of session invalidation vulnerability in Graylog Web Interface CVSS 4.0CRITICAL 9.3
TI-2023-21667 User session is still usable after logout in graylog2-server CVSS 3.1LOW 3.1
TI-2021-15624 A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate… CVSS 3.1CRITICAL 9.8
TI-2021-15623 A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to… CVSS 3.1CRITICAL 9.8

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences