CVE-2026-1441: Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

Published Feb 18, 2026

Updated

Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker to inject and execute arbitrary JavaScript code when a user visits a specially crafted URL. Exploitation of this vulnerability may allow script execution in the victim's browser and limited manipulation of the affected user's session context, through the '/system/indexsets/' endpoint.

Affected Software

2 affected components

Graylog Graylog Web Interface

Graylog Graylog=2.2.3

Remediation

Information

It is recommended to update the software to the latest version, where the vulnerability described has already been mitigated. For the affected version, the vulnerability is not mitigated, as the manufacturer considers all versions prior to the current one to be obsolete.

Event History

Feb 18, 2026

CVE Published

via MITRE·01:14 PM

Data Sourced

via MITRE·01:14 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Nov 22, 58104

Event

via NVD·04:19 AM

Frequently Asked Questions

What is the severity of CVE-2026-1441?

CVE-2026-1441 is classified as a high-severity reflected Cross-Site Scripting (XSS) vulnerability.

How do I fix CVE-2026-1441?

To fix CVE-2026-1441, update Graylog Web Interface to the latest version that addresses this XSS vulnerability.

What causes CVE-2026-1441?

CVE-2026-1441 is caused by a lack of proper sanitization and escaping of HTML output in the Graylog Web Interface.

Which version of Graylog is affected by CVE-2026-1441?

CVE-2026-1441 affects Graylog Web Interface version 2.2.3.

What are the potential risks of CVE-2026-1441?

The potential risks of CVE-2026-1441 include unauthorized access to user data and the ability for attackers to execute malicious scripts in the context of a user's session.