CVE-2026-55425: Graylog Server information disclosure in system catalog API

CVE-2026-55425 · Severity: medium · CVSS 5 · Published 2026-08-28

Graylog Server's system catalog API endpoint unintentionally exposes sensitive database fields that should be protected, including user password hashes. Authenticated users can retrieve their own sensitive data, while administrators can access password hashes of all users. This allows attackers with valid credentials to gather security-sensitive information that could facilitate further attacks or credential compromise.

Technologies: org.graylog2:graylog2-server (Maven). Vendors: Graylog, Maven.

Quick answers

Is CVE-2026-55425 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55425 being exploited in the wild.
How severe is CVE-2026-55425?
Medium severity, with a CVSS score of 5, published 28 August 2026.
Which products and versions are affected?
Graylog Server 7.1.0 through 7.1.3; org.graylog2:graylog2-server (Maven) >= 7.1.0, <= 7.1.3, ECOSYSTEM:introduced=7.1.0,fixed=7.1.4.
Is there a fix for CVE-2026-55425?
Yes. org.graylog2:graylog2-server (Maven): upgrade to 7.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55425 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55425?
Check whether you run Graylog Server or org.graylog2:graylog2-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.graylog2:graylog2-server (Maven): upgrade to 7.1.4 or later
    # set org.graylog2:graylog2-server to 7.1.4 in your pom.xml or build.gradle

Technical details

The vulnerability exists in Graylog's API endpoint for retrieving system catalog entity titles. The root cause is insufficient output filtering that fails to restrict access to sensitive database fields. An authenticated attacker can send a crafted API request to retrieve protected fields such as user password hashes (not plaintext passwords) that should never be exposed through the API. While permission checks remain in place, users can still access their own sensitive data, and administrators with admin roles can retrieve password hashes for all users. The vulnerability requires authentication and network reachability to the API. Graylog patched this issue in version 7.1.4 by implementing an allow list to validate which fields can be accessed, rejecting requests for protected fields.

Affected products

  • Graylog Graylog Server 7.1.0 through 7.1.3

Identifiers

  • CVE-2026-55425
  • GHSA-q79r-r9xg-r863

Timeline

  • 2026-07-03: disclosed: Published to GitHub Advisory Database
  • 2026-08-28: advisory: Updated in GitHub Advisory Database
  • 2026-08-28: patched: Fix released in Graylog 7.1.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.