CVE-2026-92789: Graylog SSRF Vulnerability via Redirects

CVE-2026-92789 Overview

CVE-2026-92789 is a Server-Side Request Forgery (SSRF) vulnerability in Graylog through version 7.1.4. The application validates outbound URLs against an allowlist before issuing HTTP requests but fails to re-validate the destination after following HTTP redirects. Authenticated attackers with lookup table or event notification permissions can craft an allowlisted endpoint that returns a redirect to an internal service. The Graylog server follows the redirect and returns the internal response to the caller, exposing internal metadata endpoints, cloud instance credentials, or other non-public services. The weakness is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated users can pivot Graylog into an SSRF proxy to reach internal-only services and retrieve sensitive responses.

Affected Products

Graylog through 7.1.4
Graylog HTTPJSONPathDataAdapter component (lookup tables)
Graylog event notification HTTP integrations

Discovery Timeline

2026-09-16 - CVE-2026-92789 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92789

Vulnerability Analysis

Graylog exposes several features that make outbound HTTP requests on behalf of authenticated users, including the HTTPJSONPathDataAdapter for lookup tables and event notification webhooks. To prevent abuse, the server checks the user-supplied URL against an administrator-configured allowlist before dispatching the request. The check occurs once, prior to the initial request. When the remote endpoint responds with an HTTP 3xx redirect, the HTTP client follows the Location header without re-running the allowlist validation against the new target. An attacker who controls or can influence a host inside the allowlist can therefore chain a redirect to any URL the Graylog server can reach, including http://169.254.169.254/ cloud metadata endpoints, internal admin panels, or other services bound to loopback. The response body is returned to the caller, turning Graylog into a read-oriented SSRF proxy.

Root Cause

The root cause is missing re-validation of the redirect target inside the outbound HTTP request path. The allowlist enforcement runs only on the original URL, and the underlying HTTP client is left with default redirect-following behavior. Relevant logic can be reviewed in the Graylog2 HTTPJSONPathDataAdapter source and the tracking Graylog2 Issue #26591.

Attack Vector

The attacker needs a Graylog account with permission to create or modify lookup tables or event notifications. They configure a data adapter or webhook pointing to an allowlisted endpoint under their control. That endpoint returns a 302 redirect to an internal address such as http://127.0.0.1:9200/ or a cloud metadata service. Graylog follows the redirect, executes the request from its own network context, and surfaces the response body through the lookup or notification result. Full details are documented in the Vulncheck advisory for Graylog.

Detection Methods for CVE-2026-92789

Indicators of Compromise

Outbound HTTP requests from Graylog server IPs to allowlisted hosts immediately followed by connections to RFC1918, loopback, or link-local addresses such as 169.254.169.254.
Lookup table or event notification configurations pointing to newly created or externally hosted allowlisted domains.
Graylog process making requests to internal-only services on ports such as 9200, 8080, 2375, or cloud metadata endpoints.

Detection Strategies

Enable HTTP client debug logging on Graylog and alert on 3xx responses whose Location header resolves to private, loopback, or metadata IP ranges.
Audit HTTPJSONPathDataAdapter and event notification definitions for URLs pointing to third-party redirect services or attacker-controlled domains.
Correlate Graylog user activity with outbound network flows to identify low-privilege accounts configuring new HTTP data adapters.

Monitoring Recommendations

Forward Graylog audit logs and outbound proxy logs into a centralized data lake and alert on redirect chains that cross the public-to-private boundary.
Monitor for access attempts from the Graylog host to cloud metadata IPs and instance identity endpoints.
Track creation and modification events for lookup tables and event notifications by non-administrative users.

How to Mitigate CVE-2026-92789

Immediate Actions Required

Upgrade Graylog to a fixed release once available from the vendor and track status in Graylog2 Issue #26591.
Restrict lookup table and event notification permissions to trusted administrators only.
Place Graylog behind an egress proxy that blocks requests to RFC1918, loopback, and cloud metadata ranges.

Patch Information

No fixed version is listed in the NVD record at publication time. Monitor the Graylog2 server repository and vendor release notes for a patched build that re-validates redirect targets against the outbound allowlist.

Workarounds

Remove or tightly scope the outbound URL allowlist so it contains only fully controlled hosts that do not issue redirects.
Front the Graylog server with a forward proxy that drops responses containing Location headers pointing to internal ranges.
Enforce IMDSv2 on cloud instances and block metadata access from the Graylog workload identity where possible.
Revoke lookup table and notification permissions from non-admin roles until a patched release is deployed.

bash

# Example egress restriction using iptables on the Graylog host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner graylog -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner graylog -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner graylog -j REJECT