CVE-2025-46827: Graylog Log Management Platform XSS Vulnerability

CVE-2025-46827 Overview

CVE-2025-46827 is a stored cross-site scripting [CWE-79] vulnerability in Graylog, the open-source log management platform. Attackers with permission to create event definitions can embed an HTML form in the Remediation Step field of an Event Definition. When another user views the alert, the form can be submitted to an active Graylog Input (HTTP, TCP raw, or syslog), capturing the victim's session cookies.

The flaw affects Graylog versions prior to 6.0.14, 6.1.10, and 6.2.0. Exploitation requires a specific chain of prerequisites but can lead to session takeover of alert-viewing users, including administrators.

Critical Impact
Successful exploitation allows an authenticated low-privilege user to steal session cookies of alert viewers, enabling account impersonation and potential privilege escalation.

Affected Products

Graylog versions prior to 6.0.14
Graylog versions prior to 6.1.10 (6.1.x branch)
Graylog versions prior to 6.2.0 (6.2.x branch)

Discovery Timeline

2025-05-07 - CVE-2025-46827 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46827

Vulnerability Analysis

The vulnerability resides in the handling of the Remediation Step field within Graylog Event Definitions. The platform renders user-supplied content in this field without sufficient output encoding or input sanitization. An attacker who can create event definitions can embed arbitrary HTML, including a complete <form> element with hidden fields and auto-submit JavaScript.

When a privileged user navigates to view an alert tied to the malicious event definition, the embedded form executes in the victim's browser session. Because Graylog session cookies are accessible to the client-side form submission, the payload can exfiltrate them to an attacker-controlled destination.

The attack is amplified by Graylog's own ingestion architecture. An attacker does not need an external server to collect stolen cookies. Any active Input on the Graylog server that accepts form data, such as an HTTP, TCP raw, or syslog input, can serve as the exfiltration endpoint.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The Remediation Step field accepts and renders raw HTML markup instead of escaping it or restricting content to a safe subset. This permits injection of form elements and script content into the alert view.

Attack Vector

Exploitation requires three preconditions: an attacker account with permission to create event definitions, a victim account with permission to view alerts, and an active Input on the Graylog server that accepts form submissions. The attacker crafts an event definition whose Remediation Step contains an HTML form targeting the Input URL, with the victim's document.cookie as a form field value. The payload submits automatically when the alert is rendered in the victim's browser.

See the GitHub Security Advisory GHSA-76vf-mpmx-777j for additional technical context.

Detection Methods for CVE-2025-46827

Indicators of Compromise

Event definitions containing HTML tags such as <form>, <script>, <iframe>, or <img onerror=> in the Remediation Step field.
Unexpected inbound messages on HTTP, TCP raw, or syslog Inputs that contain session cookie strings or Cookie: headers.
Audit log entries showing event definition creation or modification by non-administrative accounts followed by alert views from privileged users.

Detection Strategies

Query the Graylog MongoDB event_definitions collection for Remediation Step values containing HTML markup patterns.
Correlate event definition write activity with inbound Input messages that include cookie-like strings (sessionid=, long base64 tokens).
Alert on administrative session reuse from unexpected IP addresses following event definition changes.

Monitoring Recommendations

Enable and ship Graylog audit logs to an independent SIEM or data lake to retain tamper-resistant records of event definition changes.
Review existing Event Definitions in bulk and flag any that contain markup characters (<, >, &#) in the Remediation Step.
Monitor Input traffic for anomalous POST or form-encoded payloads inconsistent with the Input's documented purpose.

How to Mitigate CVE-2025-46827

Immediate Actions Required

Upgrade Graylog to version 6.0.14, 6.1.10, or 6.2.0 or later without delay.
Audit all existing Event Definitions and remove any Remediation Step content containing HTML or script markup.
Review which user roles hold event_definitions:create permissions and reduce the grant to trusted operators only.
Rotate active session tokens and administrator credentials if suspicious event definition modifications are found.

Patch Information

Graylog addressed the issue in versions 6.0.14, 6.1.10, and 6.2.0. The fix properly sanitizes or encodes the Remediation Step field so that submitted HTML is not rendered as active markup. Upgrade details and advisory text are available in GitHub Security Advisory GHSA-76vf-mpmx-777j.

Workarounds

No vendor-supplied workarounds are available. Upgrading is the only supported remediation.
As an interim risk reduction, restrict the event_definitions:create permission to a minimal set of trusted administrators until patching is complete.
Temporarily disable or firewall any Inputs that accept arbitrary form data if they are not required for production ingestion.

bash

# Example: verify installed Graylog version before and after upgrade
curl -su admin:$GRAYLOG_PW http://graylog:9000/api/system | jq '.version'

# Example: list event definitions and flag HTML markup in remediation_steps
mongosh graylog --quiet --eval '
  db.event_definitions.find(
    { remediation_steps: /<[a-z][\s\S]*>/i },
    { _id: 1, title: 1, remediation_steps: 1 }
  ).forEach(printjson)
'