Executive brief
Graylog, a log management and analysis platform, validates outbound URLs against a security allowlist before making requests. However, it fails to re-validate the target URL after following HTTP redirects. An attacker with permissions to configure lookup tables or event notifications can exploit this to redirect the server to internal services, exposing sensitive internal data or services that should be inaccessible.
Technical details
The vulnerability is a URL validation bypass in Graylog's HTTP request handling, specifically in the HTTPJSONPathDataAdapter component. The application validates URLs against an allowlist before making the initial request but does not re-validate the destination URL after following HTTP redirects (3xx responses). An attacker with lookup table or event notification configuration permissions can craft an allowlisted endpoint that redirects to an internal service (e.g., localhost, internal IPs, or private APIs). The server then fetches the redirected resource and returns the response, allowing information disclosure. The vulnerability is fixed in versions after 7.1.4.
Affected products
- Graylog Graylog through 7.1.4
Timeline
- 2026-09-16: disclosed