CVE-2023-41041

Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Each node maintains an in-memory cache of user sessions. Upon a cache-miss, the session is loaded from the database. After that, the node operates solely on the cached session. Modifications to sessions will update the cached version as well as the session persisted in the database. However, each node maintains their isolated version of the session. When the user logs out, the session is removed from the node-local cache and deleted from the database. The other nodes will however still use the cached session. These nodes will only fail to accept the session id if they intent to update the session in the database. They will then notice that the session is gone. This is true for most API requests originating from user interaction with the Graylog UI because these will lead to an update of the session's "last access" timestamp. If the session update is however prevented by setting the `X-Graylog-No-Session-Extension:true` header in the request, the node will consider the (cached) session valid until the session is expired according to its timeout setting. No session identifiers are leaked. After a user has logged out, the UI shows the login screen again, which gives the user the impression that their session is not valid anymore. However, if the session becomes compromised later, it can still be used to perform API requests against the Graylog cluster. The time frame for this is limited to the configured session lifetime, starting from the time when the user logged out. This issue has been addressed in versions 5.0.9 and 5.1.3. Users are advised to upgrade.

• CWE-613

• https://github.com/Graylog2/graylog2-server/commit/bb88f3d0b2b0351669ab32c60b595ab7242a3fe3Patch
• https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-3fqm-frhg-7c85Exploit, Vendor Advisory
• https://github.com/Graylog2/graylog2-server/commit/bb88f3d0b2b0351669ab32c60b595ab7242a3fe3Patch
• https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-3fqm-frhg-7c85Exploit, Vendor Advisory

Published

Aug 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41036Macvim is a text editor for MacOS. Prior to version 178, Mac…7.8
• CVE-2023-41037OpenPGP.js is a JavaScript implementation of the OpenPGP pro…4.3
• CVE-2023-41038Firebird is a relational database. Versions 4.0.0 through 4.…7.5
• CVE-2023-41039RestrictedPython is a restricted execution environment for P…7.7
• CVE-2023-4104An invalid Polkit Authentication check and missing authentic…5.5
• CVE-2023-41040GitPython is a python library used to interact with Git repo…6.5
• CVE-2023-41042Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2023-41043Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2023-41044Graylog is a free and open log management platform. A partia…3.8
• CVE-2023-41045Graylog is a free and open log management platform. Graylog …5.3
• CVE-2023-41046XWiki Platform is a generic wiki platform offering runtime s…6.3
• CVE-2023-41047OctoPrint is a web interface for 3D printers. OctoPrint vers…6.5