Server-Side Request Forgery in Graylog Affects Use of Internal Services

CVE-2026-92789

What is CVE-2026-92789?

Graylog versions up to 7.1.4 exhibit a vulnerability that allows for Server-Side Request Forgery (SSRF) through improper URL validation after HTTP redirects. The application initially checks outbound URLs against an allowlist but fails to validate URLs again once a redirect occurs. This flaw can be exploited by attackers who possess certain permissions, enabling them to manipulate allowlisted endpoints to redirect to internal services. As a result, the server may inadvertently fetch and return sensitive internal responses, leading to potential data exposure and security breaches.

References