CVE-2026-1439: Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

Published Feb 18, 2026

Updated

Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker to inject and execute arbitrary JavaScript code when a user visits a specially crafted URL. Exploitation of this vulnerability may allow script execution in the victim's browser and limited manipulation of the affected user's session context, through the '/

alerts

/' endpoint.

Affected Software

2 affected components

Graylog Graylog Web Interface

Graylog Graylog=2.2.3

Remediation

Information

It is recommended to update the software to the latest version, where the vulnerability described has already been mitigated. For the affected version, the vulnerability is not mitigated, as the manufacturer considers all versions prior to the current one to be obsolete.

Event History

Feb 18, 2026

CVE Published

via MITRE·01:13 PM

Data Sourced

via MITRE·01:13 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-1439?

CVE-2026-1439 is classified as a medium severity vulnerability due to its potential impact on web application security.

How do I fix CVE-2026-1439?

To fix CVE-2026-1439, upgrade your Graylog Web Interface to version 2.2.4 or later, which addresses the XSS vulnerability.

What type of vulnerability is CVE-2026-1439?

CVE-2026-1439 is a reflected Cross-Site Scripting (XSS) vulnerability.

Who is affected by CVE-2026-1439?

CVE-2026-1439 affects users of the Graylog Web Interface version 2.2.3.

What impact does CVE-2026-1439 have on my system?

CVE-2026-1439 can allow an attacker to execute arbitrary JavaScript in the context of a user's browser session.