CVE-2026-92789
Last modified
CVE-2026-92789 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup table or event notification permissions can craft allowlisted endpoints that redirect to internal services, enabling the server to fetch and return internal responses..
Description
Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup table or event notification permissions can craft allowlisted endpoints that redirect to internal services, enabling the server to fetch and return internal responses.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Graylog2 | graylog2-server | <= 7.1.4 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-92789?
How severe is CVE-2026-92789?
How do I fix CVE-2026-92789?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92783Yeti through 2.11.0 fails to validate caller permissions in …8.1
- CVE-2026-92784@refinedev/inferencer through 7.0.0 fails to escape API fiel…7.5
- CVE-2026-92785Angel through 3.3.0 deserializes untrusted setAlgoMetrics pa…8.1
- CVE-2026-92786LightGBM through 4.7.0 fails to validate child and split arr…7.8
- CVE-2026-92787Feast through 0.66.0 fails to verify JWT token signatures be…9.8
- CVE-2026-92788Coze Studio through 0.5.1 fails to validate that table names…8.8
- CVE-2026-9279Logseq exposes an IPC handler that allows the renderer proce…8.7
- CVE-2026-92790Higress before 2.2.4 panics when processing a Cookie header …6.5
- CVE-2026-92791Uber Kraken through 0.1.29 fails to validate the tag paramet…7.5
- CVE-2026-92792OpenNHP through 1.0.2 selects its trusted-execution attestat…7.5
- CVE-2026-92793GoAdmin through 1.2.26 fails to properly anchor the logout p…8.1
- CVE-2026-92794OpenSign through 2.41.3 fails to validate caller identity in…7.5
Are you affected by CVE-2026-92789?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST