# CVE-2024-52506: Graylog can leak other users' reports via concurrent PDF report rendering

> Concurrent report rendering in Graylog may leak other users' log data due to a race condition in browser instance reuse.

- **Severity:** High 7.1 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 18 Nov 2024
- **Updated:** 23 Sep 2025
- **Also known as:** GHSA-vggm-3478-vm5m

## What is CVE-2024-52506?

CVE-2024-52506 is a high-severity vulnerability in graylog2-server, published on 18 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.

### Official description

Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included in Graylog 6.1.0 & 6.1.1, is vulnerable to information leakage triggered by multiple concurrent report rendering requests from authorized users. When multiple report renderings are requested at the same start time, the headless browser instance used to render the PDF will be reused. Depending on the timing, either a check for the browser instance "freshness" hits, resulting in an error instead of the report being returned, or one of the concurrent report rendering requests "wins" and this report is returned for all report rendering requests that do not return an error. This might lead to one user getting the report of a different user, potentially leaking indexed log messages or aggregated data that this user normally has no access to. This problem is fixed in Graylog 6.1.2. There is no known workaround besides disabling the reporting functionality.

Weakness: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)

## Which versions are affected by CVE-2024-52506?

2 open source packages ship an affected version, including org.graylog:graylog-parent. It affects 1 product.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `org.graylog:graylog-parent` | Maven | From 6.1.0 | 6.1.2 |
| `org.graylog:graylog-parent` | Maven | From 6.1.0 | 6.1.2 |

Products: Graylog Graylog.

## How do I fix CVE-2024-52506?

Upgrade org.graylog:graylog-parent to 6.1.2 or later.

## Is CVE-2024-52506 being exploited?

There is no known exploitation of CVE-2024-52506 in the wild and no public exploit code.

## Other vulnerabilities in graylog2-server

- [CVE-2021-37759](https://insights.sbomify.com/CVE-2021-37759/): Information disclosure in n/a (critical 9.8)
- [CVE-2021-37760](https://insights.sbomify.com/CVE-2021-37760/): Information disclosure in n/a (critical 9.8)
- [CVE-2026-1435](https://insights.sbomify.com/CVE-2026-1435/): Incorrect management of session invalidation vulnerability in Graylog Web Interface (critical 9.3)
- [CVE-2025-53106](https://insights.sbomify.com/CVE-2025-53106/): Graylog vulnerable to privilege escalation through API tokens (high 8.8)
- [CVE-2024-24824](https://insights.sbomify.com/CVE-2024-24824/): graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request (high 8.8)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2024-52506 and fix it if it is affected.

What it is: CVE-2024-52506 is a high-severity vulnerability in graylog2-server, published on 18 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2024-52506 in the wild and no public exploit code.

Affected packages and fixed versions:
- org.graylog:graylog-parent (Maven): affected from 6.1.0; fixed in 6.1.2
- org.graylog:graylog-parent (Maven): affected from 6.1.0; fixed in 6.1.2

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2024-52506/ (Markdown: https://insights.sbomify.com/CVE-2024-52506/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2024-52506
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-52506
- OSV: https://osv.dev/vulnerability/CVE-2024-52506

---
From sbomify Insights: https://insights.sbomify.com/CVE-2024-52506/
Summaries are generated and may contain mistakes; the official description above is the record.