CVE-2026-92789 in Graylog
Summary
by MITRE • 09/16/2026
Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup table or event notification permissions can craft allowlisted endpoints that redirect to internal services, enabling the server to fetch and return internal responses.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in Graylog versions through 7.1.4 represents a classic Server-Side Request Forgery (SSRF) flaw rooted in insufficient validation logic during HTTP request handling. The application implements an allowlist mechanism designed to restrict outbound network connections to pre-approved domains or IP addresses, a common security control intended to prevent data exfiltration and access to internal resources. However, the implementation fails to enforce this restriction consistently across all stages of the HTTP transaction lifecycle. Specifically, while the initial URL is validated against the whitelist before the connection attempt begins, the application does not re-evaluate the allowlist criteria after receiving an HTTP redirect response from the target server. This gap in logic allows an attacker to bypass the security control by leveraging standard web redirection mechanisms.
From a technical perspective, this flaw exploits the behavior of HTTP status codes such as 301 Moved Permanently or 302 Found. An authorized user can configure a lookup table entry or trigger an event notification that points to an external domain permitted by the allowlist. This external server is then configured to respond with a redirect pointing toward an internal IP address, localhost, or another restricted service within the Graylog infrastructure's network perimeter. Because the application blindly follows this redirect without re-checking whether the final destination URL complies with the security policy, it proceeds to fetch data from the internal resource and subsequently returns that response to the attacker. This effectively turns the vulnerable server into a proxy for accessing otherwise inaccessible services.
The operational impact of this vulnerability is significant, particularly regarding network segmentation assumptions and data confidentiality. Attackers who possess lookup table or event notification permissions can leverage this flaw to probe internal networks, potentially discovering sensitive configuration files, database credentials stored in local services, or administrative interfaces that are not exposed to the public internet. This capability undermines the principle of least privilege by allowing lower-privileged users to perform actions typically reserved for administrators with direct network access. Furthermore, if the internal service responds with detailed error messages or data, it can aid in further reconnaissance and exploitation of other vulnerabilities within the organization's infrastructure.
This vulnerability aligns closely with CWE-918, which describes Server-Side Request Forgery (SSRF) flaws where a web application fetches a remote resource without validating the user-supplied URL. Additionally, from an offensive security perspective, this technique maps to MITRE ATT&CK tactic T1560, specifically subtechnique T1560.001 for Data Staged via Archive Collected or more broadly under lateral movement and discovery patterns where internal services are accessed indirectly through a compromised application layer. The failure to validate the final destination after redirection is a common oversight in web frameworks that prioritize performance over rigorous state validation during multi-step HTTP interactions.
To mitigate this risk, organizations running Graylog versions prior to 7.1.5 must apply the vendor-provided patch immediately as it addresses the logic gap by enforcing allowlist checks on every URL encountered during the request lifecycle, including those resulting from redirects. In environments where immediate patching is not feasible, network-level controls such as firewall rules or reverse proxy configurations should be implemented to restrict outbound connections from Graylog servers to only known external endpoints and block access to internal IP ranges entirely at the network perimeter. Additionally, input validation on user-supplied URLs should be reinforced to detect and reject redirect chains that attempt to change domains unexpectedly. Regular security audits of web application logic are recommended to identify similar patterns in other components where outbound requests are made based on user-controlled inputs.