Read the docs
TI-2025-29460 Aliases CVE-2025-46827GHSA-76vf-mpmx-777j

Graylog Allows Session Takeover via Insufficient HTML Sanitization

Priority LOW 37CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with permissions to create event definitions, while the user must have permissions to view alerts. Additionally, an active Input must be present on the Graylog server that is capable of receiving form data (e.g. a HTTP input, TCP raw or syslog etc). Versions 6.0.14, 6.1.10, and 6.2.0 fix the issue. No known workarounds are available, as long as the relatively rare prerequisites are met.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00292 21st percentileScored 2026-11-07
Fix Fixed graylog2-server (Graylog2): 6.0.14, 6.1.10org.graylog2:graylog2-server (Maven): 6.0.14, 6.1.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Graylog2graylog2-serverbefore 6.0.14; 6.1.0 to before 6.1.106.0.14, 6.1.10Patch availableCNA
—org.graylog2:graylog2-server (Maven)before 6.0.146.0.14Patch availableGHSA-76vf-mpmx-777j
—org.graylog2:graylog2-server (Maven)6.1.0 to before 6.1.106.1.10Patch availableGHSA-76vf-mpmx-777j
  • graylog2-server VendorGraylog2 Affected before 6.0.14; 6.1.0 to before 6.1.10 Fixed in 6.0.14, 6.1.10 Patch available CNA
  • org.graylog2:graylog2-server (Maven) Vendor— Affected before 6.0.14 Fixed in 6.0.14 Patch available GHSA-76vf-mpmx-777j
  • org.graylog2:graylog2-server (Maven) Vendor— Affected 6.1.0 to before 6.1.10 Fixed in 6.1.10 Patch available GHSA-76vf-mpmx-777j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:graylog:graylog:*:*:*:*:*:*:*:*before 6.0.14; 6.1.0 to before 6.1.10VulnerableGraylog2
  • cpe:2.3:a:graylog:graylog:*:*:*:*:*:*:*:* Versions before 6.0.14; 6.1.0 to before 6.1.10 Vulnerable ·Graylog2

Remediation

  • Fix · CNA graylog2-server (Graylog2) Fixed in 6.0.14, 6.1.10
  • Fix · GHSA-76vf-mpmx-777j org.graylog2:graylog2-server (Maven) Fixed in 6.0.14 Advisory →
  • Fix · GHSA-76vf-mpmx-777j org.graylog2:graylog2-server (Maven) Fixed in 6.1.10 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-46827
  2. 2026-10-03 Alias added: GHSA-76vf-mpmx-777j

References

Advisory 2

Other 1

  • TI-2024-16341 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request CVSS 3.1HIGH 8.8
  • TI-2023-21671 Insecure source port usage for DNS queries in Graylog CVSS 3.1MEDIUM 5.3
  • TI-2026-01133 Incorrect management of session invalidation vulnerability in Graylog Web Interface CVSS 4.0CRITICAL 9.3
  • TI-2023-21667 User session is still usable after logout in graylog2-server CVSS 3.1LOW 3.1
  • TI-2021-15624 A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate… CVSS 3.1CRITICAL 9.8
  • TI-2021-15623 A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to… CVSS 3.1CRITICAL 9.8
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences