CVE-2026-92789: Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect
Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup table or event notification permissions can craft allowlisted endpoints that redirect to internal services, enabling the server to fetch and return internal responses.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permissions to configure lookup tables or event notifications. The vulnerable behavior is in Graylog servers through version 7.1.4.
What access can an attacker gain through exploitation?
The attacker can cause the Graylog server to request internal services through a redirect and return the internal HTTP responses. The reported impact is exposure of confidential information; integrity and availability impact are not indicated.
Does the initial URL need to point directly to an internal service?
No. The initial outbound URL must pass Graylog's allowlist validation, but it can redirect to an internal service because the redirected destination is not re-validated.