CVE-2026-55425 Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields
Authenticated users can retrieve protected database fields, including password hashes, via the System Catalog titles endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55425?
CVE-2026-55425 is a medium-severity vulnerability in graylog2-server, published on 28 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request composite display fields without verifying that every selected field is readable. A user can retrieve protected values, including the password hash on a readable user record; ordinary users are limited to their own permitted records, while administrators can retrieve hashes for all users. This issue is fixed in versions 7.1.4 and 7.2.0-alpha.2.
Weakness: CWE-213
Which versions are affected by CVE-2026-55425?
2 open source packages ship an affected version, including org.graylog2:graylog2-server.
| Package | Affected | Fixed in |
|---|---|---|
org.graylog2:graylog2-server Maven | From 7.1.0 | 7.1.4 |
org.graylog2:graylog2-server Maven | From 7.1.0 | 7.1.4 |
How do I fix CVE-2026-55425?
Upgrade org.graylog2:graylog2-server to 7.1.4 or later.
Is CVE-2026-55425 being exploited?
There is no known exploitation of CVE-2026-55425 in the wild and no public exploit code.
Sources
Also known as GHSA-q79r-r9xg-r863.