CVE-2026-92789

Overview

Graylog versions up to 7.1.4 validate outbound URLs against an allowlist, but they do not re‑validate after HTTP redirects. An attacker with lookup table or event‑notification permissions can create a crafted allowlisted URL that redirects to an internal service, causing the Graylog server to fetch and expose internal responses.

Description

Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup table or event notification permissions can craft allowlisted endpoints that redirect to internal services, enabling the server to fetch and return internal responses.

Impact

{'confidentiality': 'Potential leakage of internal service data or sensitive logs via SSRF.', 'integrity': 'Risk of internal service manipulation if the server can issue requests to privileged endpoints.', 'availability': 'Limited; primarily a data exposure issue, but repeated requests could strain internal services.'}

Remediation

['Apply the latest Graylog patch (7.1.5 or later) where redirect validation is enforced.', 'If patching is delayed, restrict the lookup table and event‑notification permissions to trusted users only.', 'Configure the Graylog allowlist to include only fully qualified domain names and enforce strict domain matching.', 'Deploy network segmentation or firewall rules to block outbound traffic from the Graylog server to internal networks.', 'Enable logging of outbound requests and monitor for unexpected internal responses.']

Risk context

High severity (CVSS v3 6.5, v4 7.1). No EPSS data available. The vulnerability enables server‑side request forgery that can expose internal data, making timely patching and permission hardening advisable.

Affected products

• Graylog 7.1.4
• Graylog 7.1.x (pre‑7.1.5)