Graylog2 Server CVE-2026-65011

Exploitation requires a valid authenticated Graylog2 Server account with the global eventdefinitions:create permission granted - this is a low-privilege capability and may be held by any analyst-level user in environments with broad role grants. No special server configuration, non-default feature flag, or specific deployment mode is required beyond a network-accessible Graylog REST API. Exploitation is limited to confidentiality - the attacker can read but not modify or delete event definitions they do not own. The exploiting account must know or be able to guess the MongoDB ObjectID of the target private event definition; these IDs may be discoverable through other API endpoints accessible to low-privilege users. Exploitation is not possible by unauthenticated actors. The limiting factors are: requirement for at least one valid low-privilege Graylog account, network reachability of the Graylog API port, and knowledge of target definition IDs.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 5.3) accurately characterizes the risk profile: network-exploitable with low complexity requiring only a low-privilege authenticated account, but impact is bounded to partial confidentiality with no integrity or availability exposure. No EPSS score was provided in the input, so quantitative exploitation probability cannot be assessed. The vulnerability is not listed in CISA KEV, and no public exploit or POC code has been identified - real-world risk is therefore elevated primarily by insider-threat and post-compromise scenarios rather than opportunistic external exploitation. The qualitative impact is higher for organizations using Graylog as their SIEM or detection engineering platform: exposure of detection logic, threshold tuning, and alerting bindings gives an adversary meaningful insight into monitoring blind spots. Risk is compounded in multi-tenant or shared Graylog deployments where access-controlled event definitions partition detection content by team. The CVSS score of 5.3 is appropriate - this is a genuine authorization control failure with meaningful organizational impact, not a low-real-risk high-CVSS outlier.

An authenticated Graylog user with only the eventdefinitions:create permission iterates known or guessed event definition ObjectIDs - potentially enumerable via other lower-permission API calls - and issues POST /events/definitions/{id}/duplicate for each, receiving full cloned copies in their own namespace that reveal private detection queries, alerting thresholds, and notification channel bindings owned by other teams. No public exploit code exists at time of analysis; the attack requires only standard authenticated HTTP API calls against the Graylog REST interface.