Skip to content
Heist/ feed
Back to feed
High

Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect

Type: advisorySources: OSV

Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup table or event notification permissions can craft allowlisted endpoints that redirect to internal services, enabling the server to fetch and return internal responses.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-92789
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 11:12 UTC · Revision 1

Source evidence

Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect

core-osv · Original source

Published 16 Sept 2026, 20:32 UTC

Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup table or event notification permissions can craft allowlisted endpoints that redirect to internal services, enabling the server to fetch and return internal responses.

osv:CVE-2026-92789
Complete source record
{
  "id": "ff123ccdfb53b6ad42de46d3ea103fa608306af1854012e76c02032101e5a851",
  "url": "https://osv.dev/vulnerability/CVE-2026-92789",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect",
    "summary": "Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup table or event notification permissions can craft allowlisted endpoints that redirect to internal services, enabling the server to fetch and return internal responses.",
    "evidence": "osv:CVE-2026-92789",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-92789",
      "aliases": [
        "CVE-2026-92789"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/graylog2/graylog2-server",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "09a50652ae55181358cd53372b5a58ef872d451e"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "7.1.4"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "7.1.4"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "7.1.4",
            "7.1.3",
            "7.1.2",
            "7.1.1",
            "7.1.0",
            "7.1.0-rc.2",
            "7.1.0-rc.1",
            "7.1.0-beta.2",
            "7.1.0-beta.1",
            "7.1.0-alpha.3",
            "7.1.0-alpha.2",
            "7.1.0-alpha.1",
            "7.0.0-rc.1",
            "7.0.0-beta.5",
            "7.0.0-beta.4",
            "7.0.0-beta.3",
            "7.0.0-beta.2",
            "7.0.0-beta.1",
            "7.0.0-alpha.2",
            "7.0.0-alpha.1",
            "6.3.0-rc.1",
            "6.3.0-beta.5",
            "6.3.0-beta.4",
            "6.3.0-beta.3",
            "6.3.0-beta.2",
            "6.3.0-beta.1",
            "6.3.0-alpha.4",
            "6.3.0-alpha.3",
            "6.3.0-alpha.2",
            "6.3.0-alpha.1",
            "6.2.0-rc.1",
            "6.2.0-beta.4",
            "6.2.0-beta.3",
            "6.2.0-beta.2",
            "6.2.0-beta.1",
            "6.2.0-alpha.2",
            "6.2.0-alpha.1",
            "6.1.0-rc.1",
            "6.1.0-beta.4",
            "6.1.0-beta.3",
            "6.1.0-beta.2",
            "6.1.0-beta.1",
            "6.1.0-alpha.8",
            "6.1.0-alpha.7",
            "6.1.0-alpha.6",
            "6.1.0-alpha.5",
            "6.1.0-alpha.4",
            "6.1.0-alpha.3",
            "6.1.0-alpha.2",
            "6.1.0-alpha.1",
            "6.0.0-rc.1",
            "6.0.0-beta.5",
            "6.0.0-beta.4",
            "6.0.0-beta.3",
            "6.0.0-beta.2",
            "6.0.0-beta.1",
            "6.0.0-alpha.3",
            "6.0.0-alpha.2",
            "6.0.0-alpha.1",
            "5.2.0-rc.1",
            "5.2.0-beta.3",
            "5.2.0-beta.2",
            "5.2.0-beta.1",
            "5.2.0-alpha.1",
            "5.1.0-rc.1",
            "5.1.0-beta.3",
            "5.1.0-beta.2",
            "5.1.0-beta.1",
            "5.0.0-rc.1",
            "5.0.0-beta.5",
            "5.0.0-beta.4",
            "5.0.0-beta.3",
            "5.0.0-beta.2",
            "5.0.0-beta.1",
            "5.0.0-alpha.1",
            "4.3.0-rc.1",
            "4.3.0-beta.3",
            "4.3.0-beta.2",
            "4.3.0-beta.1",
            "4.2.0-beta.1",
            "4.1.0",
            "4.1.0-rc.1",
            "4.1.0-beta.2",
            "4.1.0-beta.1",
            "4.0.0-rc.1",
            "4.0.0-beta.4",
            "4.0.0-beta.3",
            "4.0.0-beta.2",
            "4.0.0-beta.1",
            "3.3.0-rc.1",
            "3.3.0-beta.3",
            "3.3.0-beta.2",
            "3.3.0-beta.1",
            "3.2.0-rc.1",
            "3.2.0-beta.4",
            "3.2.0-beta.3",
            "3.2.0-beta.2",
            "3.2.0-beta.1",
            "3.1.0",
            "3.1.0-rc.2",
            "3.1.0-rc.1",
            "3.1.0-beta.3",
            "3.1.0-beta.2",
            "3.1.0-beta.1",
            "3.0.0-beta.1",
            "3.0.0-alpha.5",
            "3.0.0-alpha.4",
            "3.0.0-alpha.3",
            "3.0.0-alpha.2",
            "3.0.0-alpha.1",
            "3.0.0-alpha.0",
            "2.4.0-alpha.3",
            "2.4.0-alpha.2",
            "2.4.0-alpha.1",
            "2.3.0-rc.1",
            "2.3.0-beta.1",
            "2.3.0-alpha.3",
            "2.3.0-alpha.2",
            "2.3.0-alpha.1",
            "2.2.0",
            "2.2.0-rc.1",
            "2.2.0-beta.6",
            "2.2.0-beta.5",
            "2.2.0-beta.4",
            "2.2.0-beta.3",
            "2.2.0-beta.2",
            "2.2.0-beta.1",
            "2.2.0-alpha.4",
            "2.2.0-alpha.3",
            "2.2.0-alpha.2",
            "2.2.0-alpha.1",
            "2.1.0-rc.1",
            "2.1.0-beta.4",
            "2.1.0-beta.3",
            "2.1.0-beta.2",
            "2.1.0-beta.1",
            "2.1.0-alpha.2",
            "2.1.0-alpha.1",
            "2.0.0-beta.3",
            "2.0.0-beta.2",
            "2.0.0-beta.1",
            "2.0.0-alpha.5",
            "2.0.0-alpha.4",
            "2.0.0-alpha.3",
            "2.0.0-alpha.2",
            "2.0.0-alpha.1",
            "1.2.0-rc.4",
            "1.2.0-rc.3",
            "1.2.0-rc.2",
            "1.2.0-rc.1",
            "1.1.0-rc.1",
            "1.1.0-beta.3",
            "1.1.0-beta.2",
            "1.1.0-beta.1",
            "1.0.0-beta.1",
            "0.21.0-rc.1",
            "0.21.0-beta4",
            "0.21.0-beta3",
            "0.21.0-beta2",
            "0.21.0-beta1",
            "v0.20.0-rc.1-1",
            "0.20.0-rc.1-1",
            "0.20.0-rc.1",
            "0.20.0-preview.6",
            "0.20.0-preview.5",
            "0.20.0-preview.4",
            "0.20.0-preview.3",
            "0.20.0-preview.2",
            "v0.20.0-preview.1",
            "0.20.0-preview.1",
            "0.11.0",
            "0.10.0",
            "0.10.0-rc.4",
            "0.10.0-rc.3",
            "0.10.0-rc.2",
            "0.10.0-rc.1",
            "0.10.0-preview.2",
            "0.9.7-preview.1",
            "0.9.6",
            "0.9.6-beta",
            "0.9.6-PREVIEW.3",
            "0.9.6-PREVIEW.2",
            "0.9.6-PREVIEW",
            "0.9.5p1",
            "0.9.5",
            "0.9.4p1",
            "0.9.4",
            "0.9.3",
            "0.9.2",
            "0.9.1",
            "0.9"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92789.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:34.668195949Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92789.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-92789",
        "https://www.vulncheck.com/advisories/graylog-through-7.1.4-server-side-request-forgery-via-http-redirect",
        "https://github.com/Graylog2/graylog2-server/issues/26591",
        "https://github.com/Graylog2/graylog2-server",
        "https://github.com/Graylog2/graylog2-server/blob/abb14d1/graylog2-server/src/main/java/org/graylog2/lookup/adapters/HTTPJSONPathDataAdapter.java#L158-L195"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-918"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92789.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-92789",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 501962,
  "published_at": "2026-09-16T20:32:45.37+00:00"
}