# CVE-2026-92789: Graylog URL validation bypass via HTTP redirects

Source: https://junglewise.ai/threats/cve-2026-92789-graylog-url-validation-bypass-via-http-redirects  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92789 · Severity: medium · CVSS 6.5 · Published 2026-09-16

Graylog, a log management and analysis platform, validates outbound URLs against a security allowlist before making requests. However, it fails to re-validate the target URL after following HTTP redirects. An attacker with permissions to configure lookup tables or event notifications can exploit this to redirect the server to internal services, exposing sensitive internal data or services that should be inaccessible.

Technologies: [Graylog](https://junglewise.ai/threats/technologies/graylog). Vendors: [Graylog](https://junglewise.ai/threats/vendors/graylog).

## Quick answers

**Is CVE-2026-92789 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92789 being exploited in the wild.

**How severe is CVE-2026-92789?** Medium severity, with a CVSS score of 6.5, published 16 September 2026.

**Which products and versions are affected?** Graylog through 7.1.4.

**Is there a fix for CVE-2026-92789?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92789 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-92789?** Check whether you run Graylog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a URL validation bypass in Graylog's HTTP request handling, specifically in the HTTPJSONPathDataAdapter component. The application validates URLs against an allowlist before making the initial request but does not re-validate the destination URL after following HTTP redirects (3xx responses). An attacker with lookup table or event notification configuration permissions can craft an allowlisted endpoint that redirects to an internal service (e.g., localhost, internal IPs, or private APIs). The server then fetches the redirected resource and returns the response, allowing information disclosure. The vulnerability is fixed in versions after 7.1.4.

## Affected products

- Graylog Graylog through 7.1.4

## Timeline

- 2026-09-16: disclosed

## References

- [https://github.com/Graylog2/graylog2-server](https://github.com/Graylog2/graylog2-server)
- [https://github.com/Graylog2/graylog2-server/blob/abb14d1/graylog2-server/src/main/java/org/graylog2/lookup/adapters/HTTPJSONPathDataAdapter.java](https://github.com/Graylog2/graylog2-server/blob/abb14d1/graylog2-server/src/main/java/org/graylog2/lookup/adapters/HTTPJSONPathDataAdapter.java)

## Related threats

- [Graylog privilege escalation in saved searches and dashboards API](https://junglewise.ai/threats/cve-2026-69190-graylog-privilege-escalation-in-saved-searches-and-dashboards-api)
- [Graylog syslog parser field injection in key-value message handling](https://junglewise.ai/threats/cve-2026-55841-graylog-syslog-parser-field-injection-in-key-value-message)
- [Graylog2 Server missing permission check in event definition duplication](https://junglewise.ai/threats/cve-2026-65011-graylog2-server-missing-permission-check-in-event-definition)