CVE-2026-55425

Executive Summary

CVE-2026-55425 is an authorization bypass vulnerability in Graylog's System Catalog entity titles endpoint, affecting versions 7.1.0 through 7.1.4 and the 7.2.0-alpha.1 development build. An authenticated user with low privileges can request composite display fields from the entity titles API without the system verifying that every selected field is readable by that user, allowing retrieval of protected values such as password hashes. While ordinary users are constrained to their own permitted records, administrators can leverage this flaw to extract password hashes for all users in the system, significantly expanding the attack surface for credential compromise.

Technical Analysis

The vulnerability resides in the System Catalog entity titles endpoint, specifically implemented in the file graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java. The flaw is classified as CWE-213 (Exposure of Sensitive Information Due to Incompatible Policies), indicating a mismatch between the intended data exposure policy and what the implementation actually permits.

The mechanism of the vulnerability is an incomplete authorization check. When an authenticated user requests composite display fields — a feature that allows querying multiple entity fields in a single API call — the endpoint fails to verify that all requested fields are within the user's read permission scope. The authorization logic appears to validate access at the entity level (i.e., whether the user can read the entity record itself) but does not perform field-level access control checks for each individual field requested in the composite display configuration.

The attack surface is the REST API, accessible over the network. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) confirms this is network-exploitable, requires only low privileges (an authenticated standard user account), involves no user interaction, and has a scope change (the compromised resource is outside the original authorization boundary). The confidentiality impact is rated Low because the primary sensitive value exposed is the password hash — which requires offline cracking to leverage — rather than plaintext credentials.

The practical impact differs by role:

• Standard users: Limited to their own permitted records. A standard user can potentially retrieve their own password hash, which is already within their account's data sphere but normally stored in a salted, hashed format not intended for direct exposure.
• Administrators: Can retrieve password hashes for ALL users in the system. This is the more severe exploitation path, as it gives a compromised admin account the ability to harvest credential material for the entire user base.

The affected versions are 7.1.0 through 7.1.4 (exclusive of the fix) and 7.2.0-alpha.1 (the alpha.2 release contains the fix). The fix in 7.1.4 and 7.2.0-alpha.2 adds the missing field-level authorization verification. Per the patch confidence assessment (0/4), no patch evidence from external tracked sources was available at the time of this report, though the vendor's own advisory indicates fixed versions exist.

Exploitation Scenarios

An attacker must first obtain valid credentials for a Graylog account. This could be achieved through phishing, credential stuffing against the login portal, password reuse attacks, or by compromising a legitimate user's account through other means. Graylog deployments often expose a web interface on TCP port 9000, which is the primary authentication surface.

Step 1 — Reconnaissance and Target Identification: The attacker identifies a Graylog instance running an affected version (7.1.0 through 7.1.4, or 7.2.0-alpha.1). This can be done by fingerprinting the login page, inspecting HTTP responses, or querying Shodan with the Graylog product identifiers. The attacker confirms the version by checking the login page footer or version indicator if exposed.

Step 2 — Authentication and Endpoint Discovery: The attacker authenticates with low-privileged credentials. Once authenticated, they interact with the System Catalog entity titles endpoint — the same endpoint described in the vulnerable EntityTitleServiceImpl.java. The endpoint accepts requests for composite display fields, which specify which entity fields should be included in the response.

Step 3 — Triggering the Authorization Bypass: The attacker crafts a request to the entity titles API that requests composite display fields. The critical action is including fields that the user should not be able to read — most notably the password field on user records, which contains the hashed password. Due to the missing field-level authorization check, the server processes the request and returns the protected fields without raising an error. Note that due to insufficient technical detail in the public description, the exact request format is not specified; the attack is understood at the vulnerability-class level (missing field-level access control in a REST API composite field retrieval).

Step 4 — Post-Exploitation Impact:

• Standard user scenario: The attacker retrieves their own password hash. This has limited direct utility since the attacker already controls that account, but it could reveal weak hashing practices or enable offline cracking of the hash to recover the plaintext password, which might be reused on other systems.
• Administrator scenario: If the attacker has compromised an admin account, they can retrieve password hashes for all users. These hashes can be subjected to offline cracking attacks (dictionary, brute-force, or rainbow table). Compromised hashes corresponding to strong passwords may still be usable in pass-the-hash scenarios if the underlying authentication mechanism supports it, though for web-based log management platforms this is less common. The realistic outcome is that weak user passwords are cracked, granting additional account access.

The exploitation chain is entirely network-based and requires no user interaction. No public PoC has been released as of this report; therefore, the attack chain is inferred from the vulnerability class (CWE-213 authorization mismatch) and the NVD description.

Proof of Concept Intelligence

1) Why exploitation may still be possible: The vulnerability is a logic flaw in authorization checks, not a memory corruption issue or race condition that would make exploitation environment-specific. The flaw exists in the application-level code path of the REST API and is deterministic: any authenticated request to the entity titles endpoint requesting composite display fields with protected fields will trigger the issue. The absence of a public PoC does not indicate difficulty of exploitation; it likely reflects that this is a newly disclosed issue with limited researcher attention so far. The vulnerability class is well-understood, and the fix description provides sufficient conceptual detail for a competent penetration tester to reproduce the issue.

2) Resources defenders should monitor:

• Graylog's GitHub repository: The graylog2-server repository will likely receive issue reports and possibly PoC commits from researchers. Monitoring the repository's issues and pull requests relating to EntityTitleServiceImpl.java is recommended.
• NVD and vendor advisory pages: The NVD entry for CVE-2026-55425 may be updated with additional references, exploit-db entries, or vendor advisories as they become available.
• Exploit databases: Exploit-DB and GitHub (search for "CVE-2026-55425") should be monitored for nascent PoC code.
• Security research blogs: Graylog-specific security research and general log management platform security writeups should be tracked.
• Dark web/underground forums: If the vulnerability gains attention in criminal circles, password-hash harvesting tactics may be discussed there.

Impact Assessment

Business Impact: The primary risk is credential exposure. Password hashes for user accounts, including potentially administrative accounts, can be extracted and subjected to offline cracking. Given that Graylog is a log management platform, many organizations use internally shared or low-complexity passwords for such tools, increasing the likelihood that offline cracking will succeed. Compromised Graylog credentials can provide access to sensitive log data, which itself may contain credentials, API keys, or sensitive operational information.

Affected Systems: All Graylog instances running versions 7.1.0 through 7.1.4 and 7.2.0-alpha.1. The vulnerability is in the server component (the REST resource implementation), meaning both single-node and clustered deployments are affected.

Blast Radius: The CVSS scoring reflects a severity of 5.0 (Medium). The scope change (S:C) indicates the compromised resource (user record data) is outside the original authorization boundary (the user's own permitted records). The confidentiality impact is Low (C:L), reflecting that only password hashes are exposed — not plaintext passwords or other sensitive data. Integrity and availability are unaffected. However, the real-world impact may exceed the CVSS rating in environments where: (a) users reuse passwords across systems, (b) weak password policies are in place, or (c) a compromised admin account allows broad data access beyond the immediate scope of this flaw.

Detection Guidance

The following detection content targets the behavior associated with the authorization bypass in the entity titles API.

Sigma Rule

title: Graylog Entity Title API Unauthorized Field Access
id: 4c9a1a2e-7d4b-4a1b-9c7e-1e9c5a8d4f2b
status: experimental
description: Detects requests to Graylog entity titles API attempting to access password hash fields without proper authorization
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55425
author: Valtersit SOC
date: 2026/05/15
logsource:
    category: webserver
    product: graylog
detection:
    selection:
        cs-uri-query|contains:
            - 'entity_titles'
            - 'titles'
            - 'contentpacks'
    field_access:
        cs-uri-query|contains|all:
            - 'fields'
            - 'password'
    condition: selection and field_access
level: medium
falsepositives:
    - Legitimate administrative queries that request user metadata
    - Monitor for excessive frequency or broad field requests across multiple users

YARA Rule

rule CVE_2026_55425_Graylog_Entity_Title_ByPass
{
    meta:
        author = "Valtersit SOC"
        description = "Detect attempts to exploit CVE-2026-55425 in Graylog entity titles API"
        date = "2026-05-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55425"
        severity = "medium"
    strings:
        $s1 = "EntityTitleService" ascii nocase
        $s2 = "composite display" ascii nocase
        $s3 = "contentpacks/titles" ascii nocase
        $s4 = "password" ascii nocase
        $s5 = "fields" ascii nocase
    condition:
        uint16(0) == 0x5A4D and
        (all of them) or
        (any of ($s1, $s3) and all of ($s4, $s5))
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-55425 Graylog Entity Title API Password Hash Access";
    http.uri;
    content:"titles";
    nocase;
    content:"contentpacks";
    nocase;
    distance:0;
    content:"fields";
    nocase;
    content:"password";
    nocase;
    metadata:
    created_at 2026_05_15,
    updated_at 2026_05_15,
    cve CVE-2026-55425;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-55425;
    sid:10055425;
    rev:1;
    classtype:attempted-recon;
)

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where process.name : "graylog*" and network.direction : "egress"]
  [http where http.request.method : "POST" and http.request.body.text : "*entity_titles*" and http.request.body.text : "*password*" and http.request.body.text : "*fields*"]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%contentpacks%") AND like(uri_path, "%titles%") AND like(uri_query, "%fields%") AND like(uri_query, "%password%")
| eval attack_potential=case(
    like(uri_query, "%user%") AND like(uri_query, "%all%"), "High - broad user field access",
    like(uri_query, "%password%"), "Medium - password hash field requested",
    true(), "Low"
  )
| stats count by src_ip, user, uri_path, attack_potential, _time
| sort - count

Wazuh OSSEC Rule

<rule id="268654" level="10">
    <if_sid>31100</if_sid>
    <field name="url">\.?contentpacks.*titles</field>
    <regex>fields.*password</regex>
    <description>Graylog CVE-2026-55425 - Entity title API accessed with password field request</description>
    <group>graylog,cve_2026_55425,webserver_access,</group>
    <mitre>
        <id>T1213</id>
    </mitre>
    <info type="cve">CVE-2026-55425</info>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source)

The vendor has indicated fixed versions (7.1.4 and 7.2.0-alpha.2), and the NVD description confirms the fix. However, no external patch evidence has been observed from tracked sources at the time of writing. Organizations should validate the fix presence in their environments.

1) Immediate Mitigations:

• Upgrade immediately: Upgrade Graylog to version 7.1.4 or 7.2.0-alpha.2 (or later) as these contain the fix.
• Tighten access to the API: If upgrading is not immediately possible, restrict access to the entity titles REST endpoint through reverse-proxy ACLs or network firewall rules. Limit API access to trusted admin networks.
• Monitor administrator accounts: Since the most severe impact requires an admin account, audit and review administrator account activity, especially API calls to the System Catalog endpoints.
• Enable strong authentication: Enforce MFA for all Graylog accounts, especially admin accounts, to reduce the risk of credential compromise that would enable this attack.

2) Patch/Upgrade Steps:

• Test the upgrade in a staging environment first, using the official Graylog upgrade documentation.
• Perform a full backup of the Graylog configuration and data before upgrading.
• Upgrade the Graylog server to 7.1.4 (stable) or 7.2.0-alpha.2 (alpha channel). Verify the installation by checking the version string in the UI or via /api/system/status after upgrade.
• Re-verify that the entity titles endpoint no longer returns password hash fields to unauthorized users by testing with a low-privileged test account.

3) Long-Term Hardening:

• Field-level access control: Review Graylog's documented capabilities for field-level access control and ensure that custom roles and permissions are configured following least-privilege principles.
• Credential hygiene: Enforce strong password policies, mandate MFA, and audit password reuse. Consider integrating Graylog with an enterprise SSO/LDAP solution to centralize credential management.
• Log monitoring: Enable audit logging on Graylog API access and feed those logs to your SIEM to detect unusual API behavior patterns.
• Network segmentation: Place Graylog in a restricted network segment; do not expose the admin UI to the internet unless behind a VPN or bastion.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-55425
2. Graylog GitHub Repository (fix location reference): graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java
3. CWE-213 Reference: https://cwe.mitre.org/data/definitions/213.html
4. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-55425 is NOT listed (no known in-the-wild exploitation).

Known threat actor campaigns: None identified. No exploit-in-the-wild evidence is available at the time of this report.