Authentication Bypass in Graylog Log Management Platform

CVE-2025-30373

What is CVE-2025-30373?

Graylog, a popular open log management platform, is impacted by an authentication bypass vulnerability. Specifically, versions starting from 6.1 have a flaw where HTTP Inputs can be configured to validate the presence of a specific header with an expected value. Despite the correct HTTP response (401 Unauthorized) being returned when the header is missing or when the value is incorrect, the platform still accepts and processes the incoming messages, enabling potential unauthorized data ingestion. To address this issue, administrators should disable HTTP-based inputs and opt for authenticated pull-based inputs. The vulnerability is resolved in version 6.1.9.

References