Graylog vulnerabilities
We track 3 vulnerabilities in Graylog products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on February 18, 2026.
Latest Graylog vulnerabilities
- 9.8 Critical severity
Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to…
Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. The application generates a new 'sessionId' each time a user authenticates, but does not invalidate pr
- 8.8 High severity
graylog2-server: Improper Authorization
Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the
- 8.8 High severity
graylog2-server: Incorrect Authorization
Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the `/api/system/cluster_config/` endpoint. Graylog's cluster con