Is CVE-2026-65011 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65011 being exploited in the wild.

How severe is CVE-2026-65011?

Medium severity, with a CVSS score of 4.3, published 22 July 2026.

Is there a fix for CVE-2026-65011?

A patch was published on 2026-07-21: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65011 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-65011?

Check whether you run Graylog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65011: Graylog2 Server missing permission check in event definition duplication

CVE-2026-65011 · Severity: medium · CVSS 4.3 · Published 2026-07-22

Graylog2 Server, a popular log management and analysis platform, contains a security flaw that allows certain users to view private alert configurations they should not have access to. By using a 'duplicate' feature, a user with basic permissions can clone and then read sensitive event definitions, including detection queries and notification settings. This could lead to the exposure of internal monitoring logic and sensitive data handling procedures.

Technologies: Graylog. Vendors: Graylog.

Quick answers

Is CVE-2026-65011 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65011 being exploited in the wild.
How severe is CVE-2026-65011?: Medium severity, with a CVSS score of 4.3, published 22 July 2026.
Which products and versions are affected?: Graylog <= 7.1.5, <= 7.0.10.
Is there a fix for CVE-2026-65011?: A patch was published on 2026-07-21: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65011 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-65011?: Check whether you run Graylog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in the POST /events/definitions/{definitionId}/duplicate endpoint of Graylog2 Server. While the application correctly enforces per-entity permissions for direct GET requests, the duplication endpoint only verified a global 'create' permission rather than checking if the user had 'read' access to the specific entity being cloned. An authenticated attacker with the low-privilege 'eventdefinitions:create' capability can exploit this to duplicate any event definition into their own account. Once duplicated, the attacker can view sensitive configuration details such as detection queries, aggregation thresholds, grouping fields, and notification bindings. The issue is fixed in versions following commit 46a2eeb, with backports provided for the 7.0 and 7.1 release branches.

Affected products

Graylog2 graylog2-server <= 7.1.5, <= 7.0.10

Timeline

2026-07-06: disclosed: Issue reported on GitHub
2026-07-21: patched: Fix merged into master branch
2026-07-22: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.