Medium severity · published Sep 16, 2026
CVE-2026-92789
Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup table or event notification permissions can craft allowlisted endpoints that redirect to internal services, enabling the server to fetch and return internal responses.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
graylog2-server · Graylog2
through 7.1.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92789
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92789
github.com
https://github.com/Graylog2/graylog2-server
github.com
https://github.com/Graylog2/graylog2-server/blob/abb14d1/graylog2-server/src/main/java/org/graylog2/lookup/adapters/HTTPJSONPathDataAdapter.java#L158-L195
github.com
https://github.com/Graylog2/graylog2-server/issues/26591
www.vulncheck.com
https://www.vulncheck.com/advisories/graylog-through-7.1.4-server-side-request-forgery-via-http-redirect
More from graylog2-server
8.8
CVE-2025-53106
Graylog vulnerable to privilege escalation through API tokens
7.5
CVE-2026-55841
Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message
6.5
CVE-2024-52506
Graylog can leak other users' reports via concurrent PDF report rendering
6.3
CVE-2026-69190
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
5.4
CVE-2025-46827
Graylog Allows Session Takeover via Insufficient HTML Sanitization