CVE-2026-55425 Overview
CVE-2026-55425 is an information disclosure vulnerability in Graylog, an open source log management platform. The flaw resides in the System Catalog entity titles endpoint implemented in EntityTitleServiceImpl.java. Authenticated users can request composite display fields without the server verifying that every selected field is readable. Attackers can retrieve protected values such as password hashes stored on user records. Ordinary users are limited to records they can already access, while administrators can retrieve password hashes for all users. Graylog versions 7.1.0 through 7.1.3 and 7.2.0-alpha.1 are affected. The issue is fixed in 7.1.4 and 7.2.0-alpha.2.
Critical Impact
Authenticated Graylog users can extract password hashes from user records through the entity titles endpoint, enabling offline credential cracking and potential lateral movement.
Affected Products
- Graylog 7.1.0 through 7.1.3
- Graylog 7.2.0-alpha.1
- Component: graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java
Discovery Timeline
- 2026-08-28 - CVE-2026-55425 published to NVD
- 2026-08-31 - Last updated in NVD database
- Fix released - Graylog 7.1.4 and 7.2.0-alpha.2
Technical Details for CVE-2026-55425
Vulnerability Analysis
The vulnerability is an information exposure flaw classified as [CWE-213] (Exposure of Sensitive Information Due to Incompatible Policies). The System Catalog exposes an entity titles endpoint that returns display strings for referenced entities. Callers can specify which fields compose those titles. The endpoint checks that the caller can read the entity itself but does not check that each requested composite field is readable. This gap lets authenticated users project fields that are otherwise restricted, including sensitive fields on user entities. Password hashes stored on user documents become reachable through this projection path. The bug is a broken access control pattern where per-field authorization is missing while per-entity authorization is enforced.
Root Cause
The root cause is missing field-level authorization inside EntityTitleServiceImpl. The service composes a title by concatenating values from the fields the caller supplies. Authorization logic evaluates entity readability, not field readability. A user record is readable by its owner and by administrators. Once readable, any of its fields, including the password hash field, can be requested as part of the title composition. Administrators inherit read access to every user record, which amplifies impact for privileged accounts. Graylog addressed the issue in pull request 26284 by adding field-level readability checks before returning composite values.
Attack Vector
Exploitation requires an authenticated session and network access to the Graylog REST API. An attacker sends a request to the entity titles endpoint referencing user entities and specifies the password hash field as part of the requested title composition. The server returns the composed string containing the hash. A standard user can extract their own hash. An administrator can enumerate all users and collect every password hash for offline cracking. See the Graylog Security Advisory GHSA-q79r-r9xg-r863 for advisory details.
Detection Methods for CVE-2026-55425
Indicators of Compromise
- Requests to the System Catalog entity titles endpoint that reference user entities and include sensitive field names such as password in the composite field parameter.
- Administrator sessions issuing broad enumeration requests against user entity titles in short time windows.
- Unusual API access patterns from accounts that do not normally interact with the System Catalog.
Detection Strategies
- Enable Graylog REST API audit logging and alert on entity titles requests that include user entity references combined with non-default field selectors.
- Baseline normal System Catalog usage per role and flag deviations, particularly from non-administrative accounts.
- Correlate suspicious API calls with subsequent authentication anomalies, which may indicate offline hash cracking followed by credential replay.
Monitoring Recommendations
- Forward Graylog application and access logs to a centralized analytics platform for retention and correlation.
- Track authentication failure spikes and successful logins from new locations after any suspected exposure.
- Rotate API tokens and monitor for unexpected token creation events in the Graylog administration area.
How to Mitigate CVE-2026-55425
Immediate Actions Required
- Upgrade Graylog to version 7.1.4 or 7.2.0-alpha.2 without delay.
- Reset passwords for all Graylog user accounts, prioritizing administrators, after upgrading.
- Revoke and reissue API tokens associated with Graylog user accounts.
- Review REST API access logs for prior use of the entity titles endpoint against user entities.
Patch Information
The fix is delivered in Graylog 7.1.4 and 7.2.0-alpha.2. The code changes are visible in commits 1d1a91d and da7767a, and in pull request 26284. The patch adds field-level readability checks in EntityTitleServiceImpl so unauthorized fields are excluded from composite titles.
Workarounds
- Restrict network access to the Graylog REST API to trusted management networks until the patch is applied.
- Reduce the number of accounts with administrator privileges to limit the blast radius of the exposure.
- Enforce strong, unique passwords and multi-factor authentication on all Graylog accounts to raise the cost of offline hash cracking.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
