---
id: CVE-2026-92789
title: >-
  Graylog through 7.1.4 validates outbound URLs against an allowlist before
  making requests but fails to re-validate after following HTTP redirects
summary: >-
  Graylog through 7.1.4 validates outbound URLs against an allowlist before
  making requests but fails to re-validate after following HTTP redirects.
  Attackers with lookup table or event notification permissions can craft
  allowlisted endpoi…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-918
vendor: Graylog2
product: graylog2-server
affected:
  - graylog2-server <= 7.1.4
published: '2026-09-16'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:53:07.383'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92789'
references:
  - url: 'https://github.com/Graylog2/graylog2-server'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Graylog2/graylog2-server/blob/abb14d1/graylog2-server/src/main/java/org/graylog2/lookup/adapters/HTTPJSONPathDataAdapter.java#L158-L195
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Graylog2/graylog2-server/issues/26591'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/graylog-through-7.1.4-server-side-request-forgery-via-http-redirect
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00304
epssPercentile: 0.23371
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-17T19:16:59.046412Z'
ingestedAt: '2026-09-16T21:05:36.888Z'
---

## Overview

Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup table or event notification permissions can craft allowlisted endpoints that redirect to internal services, enabling the server to fetch and return internal responses.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.