CVE-2024-52506 Graylog can leak other users' reports via concurrent PDF report rendering
Concurrent report rendering in Graylog may leak other users' log data due to a race condition in browser instance reuse.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-52506?
CVE-2024-52506 is a high-severity vulnerability in graylog2-server, published on 18 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included in Graylog 6.1.0 & 6.1.1, is vulnerable to information leakage triggered by multiple concurrent report rendering requests from authorized users. When multiple report renderings are requested at the same start time, the headless browser instance used to render the PDF will be reused. Depending on the timing, either a check for the browser instance "freshness" hits, resulting in an error instead of the report being returned, or one of the concurrent report rendering requests "wins" and this report is returned for all report rendering requests that do not return an error. This might lead to one user getting the report of a different user, potentially leaking indexed log messages or aggregated data that this user normally has no access to. This problem is fixed in Graylog 6.1.2. There is no known workaround besides disabling the reporting functionality.
Weakness: CWE-200
Which versions are affected by CVE-2024-52506?
2 open source packages ship an affected version, including org.graylog:graylog-parent. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.graylog:graylog-parent Maven | From 6.1.0 | 6.1.2 |
org.graylog:graylog-parent Maven | From 6.1.0 | 6.1.2 |
Products include Graylog Graylog.
How do I fix CVE-2024-52506?
Upgrade org.graylog:graylog-parent to 6.1.2 or later.
Is CVE-2024-52506 being exploited?
There is no known exploitation of CVE-2024-52506 in the wild and no public exploit code.
Other vulnerabilities in graylog2-server
- CVE-2021-37759 Information disclosure in n/a
- CVE-2021-37760 Information disclosure in n/a
- CVE-2026-1435 Incorrect management of session invalidation vulnerability in Graylog Web Interface
- CVE-2025-53106 Graylog vulnerable to privilege escalation through API tokens
- CVE-2024-24824 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request
Sources
Also known as GHSA-vggm-3478-vm5m.