Executive brief
Graylog Server's system catalog API endpoint unintentionally exposes sensitive database fields that should be protected, including user password hashes. Authenticated users can retrieve their own sensitive data, while administrators can access password hashes of all users. This allows attackers with valid credentials to gather security-sensitive information that could facilitate further attacks or credential compromise.
Technical details
The vulnerability exists in Graylog's API endpoint for retrieving system catalog entity titles. The root cause is insufficient output filtering that fails to restrict access to sensitive database fields. An authenticated attacker can send a crafted API request to retrieve protected fields such as user password hashes (not plaintext passwords) that should never be exposed through the API. While permission checks remain in place, users can still access their own sensitive data, and administrators with admin roles can retrieve password hashes for all users. The vulnerability requires authentication and network reachability to the API. Graylog patched this issue in version 7.1.4 by implementing an allow list to validate which fields can be accessed, rejecting requests for protected fields.
Affected products
- Graylog Graylog Server 7.1.0 through 7.1.3
Timeline
- 2026-07-03: disclosed: Published to GitHub Advisory Database
- 2026-08-28: advisory: Updated in GitHub Advisory Database
- 2026-08-28: patched: Fix released in Graylog 7.1.4