CVE-2026-69190 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Attackers with edit permissions can escalate to owner privileges on saved searches and dashboards, allowing them to delete entities or remove original owners.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-69190?
CVE-2026-69190 is a medium-severity vulnerability in graylog2-server, published on 21 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
Which versions are affected by CVE-2026-69190?
6 open source packages ship an affected version, including org.graylog2:graylog2-server.
| Package | Affected | Fixed in |
|---|---|---|
org.graylog2:graylog2-server Maven | From 6.3.0 | 6.3.14 |
org.graylog2:graylog2-server Maven | From 6.3.0 | 6.3.14 |
org.graylog2:graylog2-server Maven | From 7.0.0 | 7.0.9 |
org.graylog2:graylog2-server Maven | From 7.0.0 | 7.0.9 |
org.graylog2:graylog2-server Maven | From 7.1.0 | 7.1.4 |
org.graylog2:graylog2-server Maven | From 7.1.0 | 7.1.4 |
How do I fix CVE-2026-69190?
Upgrade org.graylog2:graylog2-server to a fixed version for your release line: 6.3.14, 7.0.9 or 7.1.4.
Is CVE-2026-69190 being exploited?
There is no known exploitation of CVE-2026-69190 in the wild and no public exploit code.
Sources
Also known as GHSA-m9c2-85gv-8xr5.