PT-2026-20396 · Graylog · Graylog

Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-1440

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Graylog versions 2.2.3

Description A Reflected Cross-Site Scripting (XSS) issue exists in the Graylog Web Interface console. This is due to insufficient sanitization and escaping of HTML output. The application includes parts of the URL directly in responses without proper output encoding, which allows an attacker to inject and run arbitrary JavaScript code when a user clicks a specially designed URL. Exploitation could lead to script execution within the user's browser and potential manipulation of the user's session. The vulnerable API endpoint is /system/pipelines/.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, avoid clicking on untrusted URLs related to the Graylog Web Interface.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1440

Affected Products

Graylog

References · 4

• https://osv.dev/vulnerability/CVE-2026-1440 · Vendor Advisory
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-graylog · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-1440 · Security Note
• https://twitter.com/CVEnew/status/2024123162506489900 · Twitter Post