Read the docs
TI-2026-01136 Aliases CVE-2026-1438GHSA-cw7v-qx8m-563q

Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker to inject and execute arbitrary JavaScript code when a user visits a specially crafted URL. Exploitation of this vulnerability may allow script execution in the victim's browser and limited manipulation of the affected user's session context, through the  '/system/nodes/' endpoint.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00213 11th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Graylog2Graylog Web Interface2.2.3—No fix listedCNA
  • Graylog Web Interface VendorGraylog2 Affected 2.2.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:graylog:graylog:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableGraylog2
  • cpe:2.3:a:graylog:graylog:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Graylog2

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1438
  2. 2026-10-03 Alias added: GHSA-cw7v-qx8m-563q

References

Patch 1

  • TI-2024-16341 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request CVSS 3.1HIGH 8.8
  • TI-2023-21671 Insecure source port usage for DNS queries in Graylog CVSS 3.1MEDIUM 5.3
  • TI-2026-01133 Incorrect management of session invalidation vulnerability in Graylog Web Interface CVSS 4.0CRITICAL 9.3
  • TI-2023-21667 User session is still usable after logout in graylog2-server CVSS 3.1LOW 3.1
  • TI-2021-15624 A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate… CVSS 3.1CRITICAL 9.8
  • TI-2021-15623 A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to… CVSS 3.1CRITICAL 9.8
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences