CVE-2026-1438: Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

Published Feb 18, 2026

Updated

Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker to inject and execute arbitrary JavaScript code when a user visits a specially crafted URL. Exploitation of this vulnerability may allow script execution in the victim's browser and limited manipulation of the affected user's session context, through the '/system/nodes/' endpoint.

Affected Software

2 affected components

Graylog Graylog Web Interface

Graylog Graylog=2.2.3

Remediation

Information

It is recommended to update the software to the latest version, where the vulnerability described has already been mitigated. For the affected version, the vulnerability is not mitigated, as the manufacturer considers all versions prior to the current one to be obsolete.

Event History

Feb 18, 2026

CVE Published

via MITRE·01:13 PM

Data Sourced

via MITRE·01:13 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-1438?

CVE-2026-1438 is classified as a reflected cross-site scripting (XSS) vulnerability.

How do I fix CVE-2026-1438?

To fix CVE-2026-1438, upgrade the Graylog Web Interface to version 2.2.4 or later, which includes the necessary security patches.

What software is affected by CVE-2026-1438?

CVE-2026-1438 affects the Graylog Web Interface version 2.2.3.

What types of attacks can CVE-2026-1438 allow?

CVE-2026-1438 can allow attackers to execute arbitrary JavaScript in the context of a user's browser session.

Is CVE-2026-1438 easy to exploit?

CVE-2026-1438 can be easily exploited by an attacker who can craft a malicious URL that targets vulnerable endpoints.