CVE-2026-55841

Graylog from 6.2.0 to 6.3.12, 7.0.7, and 7.1.2 has a vulnerability in the DELETE /users/{userId}/tokens/{idOrToken} endpoint where USERS_TOKENREMOVE permission is checked against the attacker-controlled userId path parameter before resolving the token selected by idOrToken. An authenticated user can provide an authorized userId while loadById() or load() resolves a token belonging to another user, including a service account or administrator, after which destroy() deletes that token without checking AccessToken.getUserName(). The issue does not expose token contents, but unauthorized deletion causes integrity impact and can disrupt access-token-based integrations.

Graylog from 7.1.0 until 7.1.4 and 7.2.0-alpha.2 allows an authenticated user to request composite display fields in the System Catalog entity titles endpoint without verifying that every selected field is readable. A user can retrieve protected values, including password hashes on readable user records; ordinary users are limited to their own records, while administrators can retrieve hashes for all users.

Graylog, a log management platform, uses a single source port for DNS queries, which goes against recommended security practices. This could allow DNS cache poisoning attacks, where an external attacker can inject forged DNS responses into Graylog's cache.

Graylog has a partial path traversal vulnerability in the `Support Bundle` feature that allows an attacker with valid Admin role credentials to download or delete files in sibling directories. The issue is caused by improper input validation in an HTTP API resource.

In the Graylog platform, in multi-node clusters, a user session may still be used for API requests after logout until it reaches its original expiry time. Each node maintains a local cache of user sessions, leading to situations where other nodes may still accept the session after it has been removed from the local cache.