CVE-2026-65011 Graylog2 CVE debrief

Who should care

Users of Graylog2 Server before commit 46a2eeb should be aware of this vulnerability and take steps to mitigate it. Specifically, administrators and users with the eventdefinitions:create capability should be cautious when duplicating event definitions.

Technical summary

The vulnerability exists in the POST /events/definitions/{definitionId}/duplicate endpoint of Graylog2 Server before commit 46a2eeb. A missing per-entity permission check allows authenticated users to clone any event definition, potentially leading to unauthorized access to sensitive information such as detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings. This could allow attackers with the low-privilege eventdefinitions:create capability to read private event definitions. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Users should review and update permissions, and consider additional security controls to protect sensitive event definitions.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it could allow attackers to access sensitive information.

Recommended defensive actions

• Apply the patch from commit 46a2eeb or later
• Restrict access to the POST /events/definitions/{definitionId}/duplicate endpoint
• Monitor for suspicious activity related to event definition duplication
• Review and update user permissions and capabilities
• Consider implementing additional security controls to protect sensitive event definitions

Evidence notes

The CVE record was published on 2026-07-22T17:16:58.837Z and has not been modified since then. The NVD entry is currently 5.3 MEDIUM. Limited information is available about the affected scope and vendor remediation.

Official resources