Read the docs
TI-2025-33099 Aliases CVE-2025-53106GHSA-3m86-c9x3-vwm9

Graylog vulnerable to privilege escalation through API tokens

Priority LOW 39CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID. For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation. This issue has been patched in versions 6.2.4 and 6.3.0-rc.2. A workaround involves disabling the respective configuration found in System > Configuration > Users > "Allow users to create personal access tokens".

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00608 49th percentileScored 2026-11-07
Fix Fixed graylog2-server (Graylog2): 6.2.4, 6.3.0-rc.2org.graylog2:graylog2-server (Maven): 6.2.4, 6.3.0-rc.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Graylog2graylog2-server6.2.0 to before 6.2.4; 6.3.0-alpha.1 to before 6.3.0-rc.26.2.4, 6.3.0-rc.2Patch availableCNA
—org.graylog2:graylog2-server (Maven)6.2.0 to before 6.2.46.2.4Patch availableGHSA-3m86-c9x3-vwm9
—org.graylog2:graylog2-server (Maven)6.3.0-alpha.1 to before 6.3.0-rc.26.3.0-rc.2Patch availableGHSA-3m86-c9x3-vwm9
  • graylog2-server VendorGraylog2 Affected 6.2.0 to before 6.2.4; 6.3.0-alpha.1 to before 6.3.0-rc.2 Fixed in 6.2.4, 6.3.0-rc.2 Patch available CNA
  • org.graylog2:graylog2-server (Maven) Vendor— Affected 6.2.0 to before 6.2.4 Fixed in 6.2.4 Patch available GHSA-3m86-c9x3-vwm9
  • org.graylog2:graylog2-server (Maven) Vendor— Affected 6.3.0-alpha.1 to before 6.3.0-rc.2 Fixed in 6.3.0-rc.2 Patch available GHSA-3m86-c9x3-vwm9

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:graylog:graylog:*:*:*:*:*:*:*:*6.2.0 to before 6.2.4VulnerableGraylog2
cpe:2.3:a:graylog:graylog:6.3.0:-:*:*:*:*:*:*6.3.0VulnerableGraylog2
cpe:2.3:a:graylog:graylog:6.3.0:alpha1:*:*:*:*:*:*6.3.0 alpha1VulnerableGraylog2
cpe:2.3:a:graylog:graylog:6.3.0:alpha2:*:*:*:*:*:*6.3.0 alpha2VulnerableGraylog2
cpe:2.3:a:graylog:graylog:6.3.0:alpha3:*:*:*:*:*:*6.3.0 alpha3VulnerableGraylog2
cpe:2.3:a:graylog:graylog:6.3.0:alpha4:*:*:*:*:*:*6.3.0 alpha4VulnerableGraylog2
cpe:2.3:a:graylog:graylog:6.3.0:beta1:*:*:*:*:*:*6.3.0 beta1VulnerableGraylog2
cpe:2.3:a:graylog:graylog:6.3.0:beta2:*:*:*:*:*:*6.3.0 beta2VulnerableGraylog2
cpe:2.3:a:graylog:graylog:6.3.0:beta3:*:*:*:*:*:*6.3.0 beta3VulnerableGraylog2
cpe:2.3:a:graylog:graylog:6.3.0:beta4:*:*:*:*:*:*6.3.0 beta4VulnerableGraylog2
  • cpe:2.3:a:graylog:graylog:*:*:*:*:*:*:*:* Versions 6.2.0 to before 6.2.4 Vulnerable ·Graylog2
  • cpe:2.3:a:graylog:graylog:6.3.0:-:*:*:*:*:*:* Versions 6.3.0 Vulnerable ·Graylog2
  • cpe:2.3:a:graylog:graylog:6.3.0:alpha1:*:*:*:*:*:* Versions 6.3.0 alpha1 Vulnerable ·Graylog2
  • cpe:2.3:a:graylog:graylog:6.3.0:alpha2:*:*:*:*:*:* Versions 6.3.0 alpha2 Vulnerable ·Graylog2
  • cpe:2.3:a:graylog:graylog:6.3.0:alpha3:*:*:*:*:*:* Versions 6.3.0 alpha3 Vulnerable ·Graylog2
  • cpe:2.3:a:graylog:graylog:6.3.0:alpha4:*:*:*:*:*:* Versions 6.3.0 alpha4 Vulnerable ·Graylog2
  • cpe:2.3:a:graylog:graylog:6.3.0:beta1:*:*:*:*:*:* Versions 6.3.0 beta1 Vulnerable ·Graylog2
  • cpe:2.3:a:graylog:graylog:6.3.0:beta2:*:*:*:*:*:* Versions 6.3.0 beta2 Vulnerable ·Graylog2
  • cpe:2.3:a:graylog:graylog:6.3.0:beta3:*:*:*:*:*:* Versions 6.3.0 beta3 Vulnerable ·Graylog2
  • cpe:2.3:a:graylog:graylog:6.3.0:beta4:*:*:*:*:*:* Versions 6.3.0 beta4 Vulnerable ·Graylog2
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:graylog:graylog:6.3.0:beta5:*:*:*:*:*:*6.3.0 beta5VulnerableGraylog2
cpe:2.3:a:graylog:graylog:6.3.0:rc1:*:*:*:*:*:*6.3.0 rc1VulnerableGraylog2
  • cpe:2.3:a:graylog:graylog:6.3.0:beta5:*:*:*:*:*:* Versions 6.3.0 beta5 Vulnerable ·Graylog2
  • cpe:2.3:a:graylog:graylog:6.3.0:rc1:*:*:*:*:*:* Versions 6.3.0 rc1 Vulnerable ·Graylog2

Remediation

  • Fix · CNA graylog2-server (Graylog2) Fixed in 6.2.4, 6.3.0-rc.2
  • Fix · GHSA-3m86-c9x3-vwm9 org.graylog2:graylog2-server (Maven) Fixed in 6.2.4 Advisory →
  • Fix · GHSA-3m86-c9x3-vwm9 org.graylog2:graylog2-server (Maven) Fixed in 6.3.0-rc.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53106
  2. 2026-10-03 Alias added: GHSA-3m86-c9x3-vwm9

References

Patch 2

Advisory 2

Other 1

  • TI-2024-16341 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request CVSS 3.1HIGH 8.8
  • TI-2023-21671 Insecure source port usage for DNS queries in Graylog CVSS 3.1MEDIUM 5.3
  • TI-2026-01133 Incorrect management of session invalidation vulnerability in Graylog Web Interface CVSS 4.0CRITICAL 9.3
  • TI-2023-21667 User session is still usable after logout in graylog2-server CVSS 3.1LOW 3.1
  • TI-2021-15624 A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate… CVSS 3.1CRITICAL 9.8
  • TI-2021-15623 A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to… CVSS 3.1CRITICAL 9.8
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences