CVE-2026-1440: Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

Published Feb 18, 2026

Updated

Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker to inject and execute arbitrary JavaScript code when a user visits a specially crafted URL. Exploitation of this vulnerability may allow script execution in the victim's browser and limited manipulation of the affected user's session context, through the '/system/pipelines/' endpoint.

Affected Software

2 affected components

Graylog Graylog Web Interface

Graylog Graylog=2.2.3

Remediation

Information

It is recommended to update the software to the latest version, where the vulnerability described has already been mitigated. For the affected version, the vulnerability is not mitigated, as the manufacturer considers all versions prior to the current one to be obsolete.

Event History

Feb 18, 2026

CVE Published

via MITRE·01:13 PM

Data Sourced

via MITRE·01:13 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-1440?

CVE-2026-1440 is classified as a reflected cross-site scripting (XSS) vulnerability that can lead to unauthorized actions or information disclosure.

How do I fix CVE-2026-1440?

To fix CVE-2026-1440, upgrade to a version of the Graylog Web Interface that includes proper input sanitization and escaping, as required.

What software is affected by CVE-2026-1440?

CVE-2026-1440 specifically affects Graylog Web Interface version 2.2.3.

What are the risks associated with CVE-2026-1440?

Risks associated with CVE-2026-1440 include potential for attackers to execute malicious scripts in the context of the user's session.

How does CVE-2026-1440 exploit work?

CVE-2026-1440 exploits the lack of proper sanitization in the HTML output, allowing an attacker to inject malicious JavaScript through crafted URLs.