CVE-2026-92789 Graylog2 CVE debrief

Who should care

Defenders responsible for Graylog instances should assess exposure and prioritize verification of the vulnerability. This includes IT administrators, security teams, and compliance officers who oversee the security and integrity of internal services. Additionally, developers and engineers involved in the maintenance and configuration of Graylog instances should be aware of this vulnerability and take necessary precautions to prevent exploitation.

Why it matters

CVE-2026-92789 is a high-severity SSRF vulnerability in Graylog that allows attackers to fetch internal responses. Defenders should prioritize verifying the vulnerability in their Graylog instances and assessing exposure to internal services.

• Verify vulnerability in Graylog instances
• Assess exposure to internal services
• Restrict permissions for lookup table and event notification
• Monitor for suspicious activity

Technical summary

Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup table or event notification permissions can craft allowlisted endpoints that redirect to internal services, enabling the server to fetch and return internal responses. This vulnerability can be exploited without authentication, and defenders should prioritize verifying the vulnerability in their Graylog instances and assessing exposure to internal services.

Defensive priority

Defenders should prioritize verifying the vulnerability in their Graylog instances and assessing exposure to internal services.

Recommended defensive actions

• Verify the vulnerability in Graylog instances
• Assess exposure to internal services
• Restrict permissions for lookup table and event notification
• Monitor for suspicious activity
• Implement additional logging and monitoring for internal service requests
• Review and update allowlists to prevent similar vulnerabilities
• Conduct regular security audits to identify and address potential weaknesses

Evidence notes

The vulnerability is caused by Graylog's failure to re-validate outbound URLs after following HTTP redirects. This allows attackers to craft allowlisted endpoints that redirect to internal services. The issue is particularly concerning because it can be exploited by attackers with lookup table or event notification permissions, which may be more common than admin-level access. Evidence of exploitation includes logs of unusual requests to internal services and monitoring of network activity for suspicious patterns.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.