# CVE-2026-55425: Graylog Server information disclosure in system catalog API

Source: https://junglewise.ai/threats/cve-2026-55425-graylog-server-information-disclosure-in-system-catalog-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55425 · Severity: medium · CVSS 5 · Published 2026-08-28

Graylog Server's system catalog API endpoint unintentionally exposes sensitive database fields that should be protected, including user password hashes. Authenticated users can retrieve their own sensitive data, while administrators can access password hashes of all users. This allows attackers with valid credentials to gather security-sensitive information that could facilitate further attacks or credential compromise.

Technologies: [org.graylog2:graylog2-server (Maven)](https://junglewise.ai/threats/technologies/org-graylog2-graylog2-server). Vendors: [Graylog](https://junglewise.ai/threats/vendors/graylog), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-55425 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55425 being exploited in the wild.

**How severe is CVE-2026-55425?** Medium severity, with a CVSS score of 5, published 28 August 2026.

**Which products and versions are affected?** Graylog Server 7.1.0 through 7.1.3; org.graylog2:graylog2-server (Maven) >= 7.1.0, <= 7.1.3, ECOSYSTEM:introduced=7.1.0,fixed=7.1.4.

**Is there a fix for CVE-2026-55425?** Yes. org.graylog2:graylog2-server (Maven): upgrade to 7.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55425 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55425?** Check whether you run Graylog Server or org.graylog2:graylog2-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.graylog2:graylog2-server (Maven): upgrade to 7.1.4 or later

  ```sh
  # set org.graylog2:graylog2-server to 7.1.4 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability exists in Graylog's API endpoint for retrieving system catalog entity titles. The root cause is insufficient output filtering that fails to restrict access to sensitive database fields. An authenticated attacker can send a crafted API request to retrieve protected fields such as user password hashes (not plaintext passwords) that should never be exposed through the API. While permission checks remain in place, users can still access their own sensitive data, and administrators with admin roles can retrieve password hashes for all users. The vulnerability requires authentication and network reachability to the API. Graylog patched this issue in version 7.1.4 by implementing an allow list to validate which fields can be accessed, rejecting requests for protected fields.

## Affected products

- Graylog Graylog Server 7.1.0 through 7.1.3

## Identifiers

- CVE-2026-55425
- GHSA-q79r-r9xg-r863

## Timeline

- 2026-07-03: disclosed: Published to GitHub Advisory Database
- 2026-08-28: advisory: Updated in GitHub Advisory Database
- 2026-08-28: patched: Fix released in Graylog 7.1.4

## References

- [https://api.github.com/users/Evelynkaz](https://api.github.com/users/Evelynkaz)
- [https://github.com/Evelynkaz](https://github.com/Evelynkaz)
- [https://api.github.com/users/Evelynkaz/gists%7B/gist_id%7D](https://api.github.com/users/Evelynkaz/gists%7B/gist_id%7D)
- [https://api.github.com/users/Evelynkaz/repos](https://api.github.com/users/Evelynkaz/repos)
- [https://avatars.githubusercontent.com/u/206716929?v=4](https://avatars.githubusercontent.com/u/206716929?v=4)
- [https://api.github.com/users/Evelynkaz/events%7B/privacy%7D](https://api.github.com/users/Evelynkaz/events%7B/privacy%7D)

## Related threats

- [Graylog privilege escalation in saved searches and dashboards API](https://junglewise.ai/threats/cve-2026-69190-graylog-privilege-escalation-in-saved-searches-and-dashboards-api)
- [Graylog token revocation endpoint IDOR](https://junglewise.ai/threats/cve-2026-55867-graylog-token-revocation-endpoint-idor)
- [Graylog syslog parser field injection in key-value message handling](https://junglewise.ai/threats/cve-2026-55841-graylog-syslog-parser-field-injection-in-key-value-message)
- [Graylog vulnerable to privilege escalation through API tokens](https://junglewise.ai/threats/cve-2025-53106-graylog-vulnerable-to-privilege-escalation-through-api-tokens)
- [Graylog Allows Session Takeover via Insufficient HTML Sanitization](https://junglewise.ai/threats/cve-2025-46827-graylog-allows-session-takeover-via-insufficient-html)