CVE-2026-92789

6.5 Moyenne

Publiée le 16/09/2026 à 23:17 · Modifiée le 22/09/2026 à 22:53 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup table or event notification permissions can craft allowlisted endpoints that redirect to internal services, enabling the server to fetch and return internal responses.

Traduire en français

Produits concernés

graylog2-server

Scores CVSS

Version	Score	Source	Vecteur
4.0	7.1 Élevée	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	6.5 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-918

Références

https://github.com/Graylog2/graylog2-server
https://github.com/Graylog2/graylog2-server/blob/abb14d1/graylog2-server/src/main/java/org/graylog2/lookup/adapters/HTTPJSONPathDataAdapter.java#L158-L195
https://github.com/Graylog2/graylog2-server/issues/26591
https://www.vulncheck.com/advisories/graylog-through-7.1.4-server-side-request-forgery-via-http-redirect

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories