Graylog2 Server
Monthly
Server-side request forgery (SSRF) in Graylog through version 7.1.4 allows an authenticated user who holds lookup table or event notification permissions to coerce the Graylog server into fetching internal services. The flaw occurs because Graylog validates outbound URLs against an allowlist only before the initial request and does not re-validate the destination after an HTTP redirect; an attacker can supply an allowlisted endpoint that redirects to an internal address, and the server returns the internal response. This is a confidentiality-only issue (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no public exploit identified at time of analysis.
Log-record tampering in Graylog's FortiGate syslog parser enables unauthenticated network senders to overwrite or erase critical security-log fields - including srcip, dstip, date, time, and tz - or cause entire log messages to be silently discarded, creating a viable log-evasion primitive. Affected are Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2 (all branches), and Graylog Forwarder prior to version 7.3, on any deployment ingesting FortiGate key-value syslog. No public exploit code exists and this is not in CISA KEV, but the attack requires no authentication and minimal crafting skill, making it a realistic threat to security-monitoring integrity in FortiGate-centric environments.
Graylog's saved-search and dashboard update API allows an authenticated user who holds edit permission on a view - but not ownership of it - to escalate to owner by attaching a crafted shareRequest to the update call, then use that ownership to delete the view or revoke the legitimate owner's access. Affected releases are Graylog 6.3.0 through 6.3.13, 7.0.0 through 7.0.8, and 7.1.0 through 7.1.3; Graylog Cloud customers were patched before the advisory was published. The flaw is rated CVSS 3.1 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), meaning it requires a low-privileged authenticated session, needs no user interaction, and is bounded to low confidentiality, integrity, and availability impact; no public exploit code identified at time of analysis and no confirmed active exploitation.
Unauthorized token deletion in Graylog's REST API (versions 6.2.0 through 6.3.11, 7.0.0-7.0.6, and 7.1.0-7.1.1) allows any authenticated user to revoke access tokens belonging to other accounts - including administrators and service accounts - by exploiting a misplaced permission check in the token revocation endpoint. The flaw does not expose token secret values but can invalidate privileged credentials and disrupt automated integrations that rely on access tokens. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 6.3.12, 7.0.7, and 7.1.2.
Graylog2 Server's event definition duplicate endpoint fails per-entity authorization, allowing any authenticated low-privilege user holding only the global `eventdefinitions:create` capability to clone event definitions they have not been granted access to. By issuing POST /events/definitions/{definitionId}/duplicate against arbitrary IDs, an attacker receives a full copy of the target definition - exposing detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings that may be restricted to other teams or roles. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the upstream fix is confirmed at commit 46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d.
Server-side request forgery (SSRF) in Graylog through version 7.1.4 allows an authenticated user who holds lookup table or event notification permissions to coerce the Graylog server into fetching internal services. The flaw occurs because Graylog validates outbound URLs against an allowlist only before the initial request and does not re-validate the destination after an HTTP redirect; an attacker can supply an allowlisted endpoint that redirects to an internal address, and the server returns the internal response. This is a confidentiality-only issue (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no public exploit identified at time of analysis.
Log-record tampering in Graylog's FortiGate syslog parser enables unauthenticated network senders to overwrite or erase critical security-log fields - including srcip, dstip, date, time, and tz - or cause entire log messages to be silently discarded, creating a viable log-evasion primitive. Affected are Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2 (all branches), and Graylog Forwarder prior to version 7.3, on any deployment ingesting FortiGate key-value syslog. No public exploit code exists and this is not in CISA KEV, but the attack requires no authentication and minimal crafting skill, making it a realistic threat to security-monitoring integrity in FortiGate-centric environments.
Graylog's saved-search and dashboard update API allows an authenticated user who holds edit permission on a view - but not ownership of it - to escalate to owner by attaching a crafted shareRequest to the update call, then use that ownership to delete the view or revoke the legitimate owner's access. Affected releases are Graylog 6.3.0 through 6.3.13, 7.0.0 through 7.0.8, and 7.1.0 through 7.1.3; Graylog Cloud customers were patched before the advisory was published. The flaw is rated CVSS 3.1 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), meaning it requires a low-privileged authenticated session, needs no user interaction, and is bounded to low confidentiality, integrity, and availability impact; no public exploit code identified at time of analysis and no confirmed active exploitation.
Unauthorized token deletion in Graylog's REST API (versions 6.2.0 through 6.3.11, 7.0.0-7.0.6, and 7.1.0-7.1.1) allows any authenticated user to revoke access tokens belonging to other accounts - including administrators and service accounts - by exploiting a misplaced permission check in the token revocation endpoint. The flaw does not expose token secret values but can invalidate privileged credentials and disrupt automated integrations that rely on access tokens. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 6.3.12, 7.0.7, and 7.1.2.
Graylog2 Server's event definition duplicate endpoint fails per-entity authorization, allowing any authenticated low-privilege user holding only the global `eventdefinitions:create` capability to clone event definitions they have not been granted access to. By issuing POST /events/definitions/{definitionId}/duplicate against arbitrary IDs, an attacker receives a full copy of the target definition - exposing detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings that may be restricted to other teams or roles. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the upstream fix is confirmed at commit 46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d.