CVE-2026-1437: Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

Published Feb 18, 2026

Updated

Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker to inject and execute arbitrary JavaScript code when a user visits a specially crafted URL. Exploitation of this vulnerability may allow script execution in the victim's browser and limited manipulation of the affected user's session context, through the '/system/authentication/users/edit/' endpoint.

Affected Software

2 affected components

Graylog Graylog Web Interface

Graylog Graylog=2.2.3

Remediation

Information

It is recommended to update the software to the latest version, where the vulnerability described has already been mitigated. For the affected version, the vulnerability is not mitigated, as the manufacturer considers all versions prior to the current one to be obsolete.

Event History

Feb 18, 2026

CVE Published

via MITRE·01:12 PM

Data Sourced

via MITRE·01:12 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-1437?

CVE-2026-1437 has been classified as having a medium severity due to its potential to allow attackers to inject malicious scripts into the Graylog Web Interface.

How do I fix CVE-2026-1437?

To fix CVE-2026-1437, update the Graylog Web Interface to version 2.2.4 or later to ensure proper sanitization and escaping of HTML output.

What types of attacks can be performed using CVE-2026-1437?

CVE-2026-1437 can be exploited for reflected Cross-Site Scripting (XSS) attacks, allowing attackers to execute arbitrary JavaScript in the context of a user's session.

Who is affected by CVE-2026-1437?

CVE-2026-1437 affects users of the Graylog Web Interface console version 2.2.3.

What can attackers gain from exploiting CVE-2026-1437?

By exploiting CVE-2026-1437, attackers can potentially steal cookies, session tokens, or other sensitive information from users of the affected Graylog Web Interface.