CVE-2025-30373: Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value
Impact Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless.
Patches
Workarounds Disabling http-based inputs and allow only authenticated pull-based inputs.
Analysis provided by Fabian Yamaguchi - Whirly Labs (Pty) Ltd
Other sources
Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless. To mitigate the vulnerability, disable http-based inputs and allow only authenticated pull-based inputs. This vulnerability is fixed in 6.1.9.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30373?
The severity of CVE-2025-30373 has been rated as a medium-risk vulnerability.
How do I fix CVE-2025-30373?
To fix CVE-2025-30373, upgrade your Graylog installation to version 6.1.10 or later, where the vulnerability is addressed.
What systems are affected by CVE-2025-30373?
CVE-2025-30373 affects Graylog versions 6.1 through 6.1.9.
What type of vulnerability is CVE-2025-30373?
CVE-2025-30373 is an authentication bypass vulnerability in HTTP Inputs of the Graylog log management platform.
How can I determine if CVE-2025-30373 is present in my system?
To determine if CVE-2025-30373 is present, verify if you are using Graylog version 6.1 to 6.1.9 and check your HTTP Input configurations for header requirements.