CVE-2026-55425: Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields
Impact
A vulnerability was found in Graylog's API endpoint for retrieving system catalog entity titles. Authenticated users could retrieve database fields of supported entities by sending a custom API request. These fields can include e.g. the password hash of a user (but not the password itself), which should not be returned through the API, regardless of the endpoint. Permission checks do still apply, so users can retrieve their own password hash, but not those of other users. The admin user (or any user with an admin role) can retrieve password hashes of all users.
Patches
This issue has been patched in Graylog 7.1.4. In this version, an allow list will be used to check if protected fields are being accessed, refusing those requests. Affected users should upgrade to 7.1.4 or above to remediate the vulnerability.
Workarounds
There is no known workaround. Upgrading to a patched version is recommended.
Credits
Thanks to Evelynkaz for reporting.
Other sources
Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request composite display fields without verifying that every selected field is readable. A user can retrieve protected values, including the password hash on a readable user record; ordinary users are limited to their own permitted records, while administrators can retrieve hashes for all users. This issue is fixed in versions 7.1.4 and 7.2.0-alpha.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.graylog2:graylog2-serverto a version that resolves this vulnerability.Fixed in 7.1.4 - Upgrade
Upgrade
Graylogto a version that resolves this vulnerability.Fixed in 7.1.4 - Upgrade
Upgrade
Graylogto a version that resolves this vulnerability.Fixed in 7.2.0-alpha.2
Event History
Frequently Asked Questions
What level of access is required to retrieve protected entity fields?
An attacker must be authenticated. Permission checks still apply: non-admin users can retrieve their own password hash but not other users' hashes, while administrators or users with an admin role can retrieve password hashes for all users.
What data may be exposed?
Supported entity database fields may be returned through a custom API request. This can include password hashes, but not users' plaintext passwords.
How is the issue remediated?
Upgrade to Graylog 7.1.4 or later. The patched version uses an allow list to reject requests for protected fields.
Is there a mitigation if an upgrade cannot be performed immediately?
No known workaround is available. Upgrading to a patched version is recommended.