# org.graylog2:graylog2-server (Maven) vulnerabilities

15 known vulnerabilities (4 high, 5 medium, 3 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Dependents: 4
- Registry: https://central.sonatype.com/artifact/org.graylog2/graylog2-server

## Advisories (15)

### [CVE-2026-69190](https://cve.now/CVE-2026-69190): Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

- Severity: Medium 6.3
- Published: Sep 21, 2026
- Affected: from 6.3.0, fixed in 6.3.14; from 7.0.0, fixed in 7.0.9; from 7.1.0, fixed in 7.1.4.

### [CVE-2026-55867](https://cve.now/CVE-2026-55867): Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

- Severity: Medium 5.3
- Published: Aug 28, 2026
- Affected: from 6.2.0, fixed in 6.3.12; from 7.0.0, fixed in 7.0.7; from 7.1.0, fixed in 7.1.2.

### [CVE-2026-55841](https://cve.now/CVE-2026-55841): Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message

- Severity: High 7.5
- Published: Aug 28, 2026
- Affected: fixed in 6.3.12; from 7.0.0, fixed in 7.0.7; from 7.1.0, fixed in 7.1.2.

### [CVE-2026-55425](https://cve.now/CVE-2026-55425): Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields

- Severity: Medium 5.0
- Published: Aug 28, 2026
- Affected: from 7.1.0, fixed in 7.1.4.

### [CVE-2025-53106](https://cve.now/CVE-2025-53106): Graylog vulnerable to privilege escalation through API tokens

- Severity: High 8.8
- Published: Jul 2, 2025
- Affected: from 6.2.0, fixed in 6.2.4; from 6.3.0-alpha.1, fixed in 6.3.0-rc.2.

### [CVE-2025-46827](https://cve.now/CVE-2025-46827): Graylog Allows Session Takeover via Insufficient HTML Sanitization

- Severity: High 8.0
- Published: May 7, 2025
- Affected: fixed in 6.0.14; from 6.1.0, fixed in 6.1.10.

### [CVE-2025-30373](https://cve.now/CVE-2025-30373): Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value

- Severity: Medium 6.5
- Published: Apr 7, 2025
- Affected: from 6.1.0, fixed in 6.1.9.

### [CVE-2024-24824](https://cve.now/CVE-2024-24824): graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request

- Severity: High 8.8
- Published: Feb 7, 2024
- Affected: from 2.0.0, fixed in 5.1.11; from 5.2.0-alpha.1, fixed in 5.2.4.

### [CVE-2024-24823](https://cve.now/CVE-2024-24823): graylog2-server Session Fixation vulnerability through cookie injection

- Severity: Medium 5.7
- Published: Feb 7, 2024
- Affected: from 4.3.0, fixed in 5.1.11; from 5.2.0-alpha.1, fixed in 5.2.4.

### [CVE-2023-41045](https://cve.now/CVE-2023-41045): Insecure source port usage for DNS queries in Graylog

- Severity: Low 3.7
- Published: Aug 31, 2023
- Affected: from 5.1.0, fixed in 5.1.3; fixed in 5.0.9.

### [CVE-2023-41044](https://cve.now/CVE-2023-41044): Partial path traversal vulnerability in Support Bundle feature of Graylog

- Severity: Low 3.3
- Published: Aug 31, 2023
- Affected: from 5.1.0, fixed in 5.1.3.

### [CVE-2023-41041](https://cve.now/CVE-2023-41041): User session is still usable after logout in graylog2-server

- Severity: Low 2.6
- Published: Aug 30, 2023
- Affected: from 1.0, fixed in 5.0.9; from 5.1.0, fixed in 5.1.3.

### [CVE-2018-14380](https://cve.now/CVE-2018-14380): In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and…

- Severity: Unrated
- Published: Jul 18, 2018
- Affected: fixed in 2.4.6.

### [CVE-2018-11651](https://cve.now/CVE-2018-11651): Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx…

- Severity: Unrated
- Published: Jun 1, 2018
- Affected: fixed in 2.4.4.

### [CVE-2018-11650](https://cve.now/CVE-2018-11650): Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.

- Severity: Unrated
- Published: Jun 1, 2018
- Affected: fixed in 2.4.4.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.graylog2:graylog2-server
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.