CVE-2026-92789

Executive Summary

CVE-2026-92789 is a server-side request forgery (SSRF) vulnerability in Graylog (through version 7.1.4) where the application validates outbound URLs against an allowlist before initiating a request but fails to re-validate the destination after following HTTP redirects. An attacker holding lookup table or event notification permissions can supply an allowlisted URL that responds with a redirect pointing at internal services, causing the Graylog server to fetch and return the internal response.

The flaw requires an authenticated account with a modest privilege level (lookup table or event notification management), giving it a CVSS base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Because Graylog frequently sits on internal networks with broad access to monitoring, logging, and infrastructure endpoints, successful exploitation can expose sensitive internal data — configuration endpoints, cloud metadata services, or admin-only APIs — to a low-privileged attacker.

Technical Analysis

The vulnerability class is CWE-918: Server-Side Request Forgery (SSRF), with the specific defect being a redirect-based allowlist bypass (a TOCTOU-style validation gap). The relevant mechanics, derived directly from the NVD description:

1. Graylog features that cause the server to make outbound HTTP(S) requests — namely lookup tables (data adapters that query external HTTP endpoints) and event notifications (HTTP notification callbacks) — perform URL validation against an allowlist before issuing the request.
2. The validation is performed only once, up-front, against the attacker-supplied URL.
3. When the target server responds with an HTTP redirect (3xx status with a Location header), Graylog's HTTP client follows the redirect but does not re-run the allowlist check on the redirect destination.
4. Consequently, an attacker who controls an allowlisted endpoint (or can make an allowlisted endpoint return a redirect) can point the server at an internal service that is not on the allowlist.

This is a classic "validate-then-follow" mistake: the security control covers the initial request but not subsequent hops in the redirect chain. The attack surface is any Graylog HTTP client path that (a) is user-configurable and (b) honors 3xx redirects.

The CVSS vector confirms the profile: AV:N (network reachable), AC:L (no special conditions), PR:L (requires the lookup table or event notification permission), UI:N (no user interaction), S:U (impact scoped to Graylog itself), and C:H / I:N / A:N — high confidentiality impact only. The server returns internal responses, so the primary loss is information disclosure; there is no stated integrity or availability impact in the vector.

Important accuracy note: The NVD description does not disclose specific function names, class names, parameter names, or the exact allowlist contents. No public PoC, Nuclei template, or exploit code is available. Details here are limited to the SSRF-with-redirect vulnerability class and the two named Graylog feature areas (lookup tables, event notifications), as stated verbatim in the description.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class described in the NVD entry.

1. Reconnaissance / target identification. The attacker identifies an exposed Graylog instance (often on port 9000 for the web interface) and obtains or already holds credentials with lookup table or event notification permissions. The attacker maps which internal hosts are not on the allowlist but are reachable from the Graylog server — e.g., internal admin panels, monitoring endpoints, and cloud instance metadata services — using the SSRF behavior itself.

2. Triggering the flaw class. Through the lookup table feature (data adapter configuration) or event notification feature (HTTP callback configuration), the attacker supplies an outbound URL that is allowlisted. This URL is validated successfully by Graylog.

3. Redirect bypass. The attacker ensures the allowlisted endpoint returns an HTTP redirect (3xx) whose Location header points to an internal, non-allowlisted target. Because Graylog follows redirects without re-validating the destination, the server issues the follow-up request to the internal service.

4. Post-exploitation impact. The internal response is fetched by the Graylog server and returned to the attacker through the lookup table result or notification path, disclosing the internal service's content. This enables information disclosure (high confidentiality impact per the CVSS vector) — for example, reading internal-only HTTP responses, service banners, or metadata endpoints. There is no stated code-execution, integrity, or availability impact.

The privilege requirement (PR:L) means this is an authenticated, low-privilege → internal-network-read escalation, not an unauthenticated internet-wide exploit. It is most dangerous in environments where Graylog has broad network reach into segmented internal networks.

Impact Assessment

• Confidentiality (C:H): Highest-impact dimension. The server can be coerced into retrieving and echoing back responses from internal services otherwise unreachable to the attacker.
• Integrity (I:N) / Availability (A:N): No stated impact. This is a read-oriented SSRF; the description does not indicate the ability to modify internal state or cause outages.
• Scope (S:U): Impact remains within Graylog's security authority, though the data obtained may originate from other systems the server can reach.
• Blast radius: Any organization running Graylog ≤ 7.1.4 with lookup table or event notification features enabled and accessible to non-administrative users. Because log management platforms often have network access to many internal segments, the SSRF pivot surface can be large.
• Business impact: Potential exposure of internal API responses, configuration data, or cloud metadata that can seed further lateral movement. Given no patch exists, unmitigated instances remain exposed indefinitely.

Detection Guidance

Detection focuses on redirect-following behavior from the Graylog server toward internal address ranges, and on anomalous egress from Graylog hosts.

Sigma Rule

title: Graylog SSRF via Redirect to Internal Address (CVE-2026-92789)
id: 8f3c1a92-7b21-4f6e-9a2c-0d4e1f7a9b33
status: experimental
description: Detects Graylog server making HTTP requests that follow redirects into internal/private address space, consistent with CVE-2026-92789 SSRF allowlist bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92789
author: valtersit.com Threat Intelligence
date: 2026-01-01
logsource:
  category: proxy
detection:
  selection_process:
    Image|endswith:
      - '\java.exe'
      - '/java'
    CommandLine|contains: 'graylog'
  selection_redirect:
    status_code:
      - 301
      - 302
      - 303
      - 307
      - 308
  selection_internal_dst:
    dst_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '169.254.0.0/16'
      - '127.0.0.0/8'
  condition: selection_process and selection_internal_dst
falsepositives:
  - Legitimate Graylog lookups or notifications configured against internal allowlisted services.
level: medium
tags:
  - attack.t1190
  - cwe.918

YARA Rule

rule CVE_2026_92789_Graylog_SSRF_Redirect
{
    meta:
        description = "Detects references to Graylog lookup/notification redirect SSRF indicators in config or logs (CVE-2026-92789)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92789"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $graylog = "graylog" nocase
        $lookup  = "lookup" nocase
        $adapter = "data_adapter" nocase
        $notif   = "notification" nocase
        $redir1  = "301" ascii
        $redir2  = "302" ascii
        $internal1 = "169.254.169.254"
        $internal2 = "127.0.0.1"
        $internal3 = "localhost"

    condition:
        $graylog and ($lookup or $adapter or $notif) and
        ($internal1 or $internal2 or $internal3) and any of ($redir*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-92789 Graylog SSRF Redirect to Internal Range"; flow:established,to_server; http.response.redirect; content:"Location|3a|"; nocase; pcre:"/Location\x3a\x20[^\r\n]*(127\.0\.0\.1|169\.254\.169\.254|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/i"; reference:cve,CVE-2026-92789; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92789; classtype:attempted-recon; sid:9278901; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [ network where process.name : ("java", "java.exe") and
      network.direction == "egress" and
      cidr_match(destination.ip, "10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","169.254.0.0/16","127.0.0.0/8") ]
  [ network where process.name : ("java", "java.exe") and
      network.direction == "egress" and
      cidr_match(destination.ip, "169.254.169.254","127.0.0.1") ]

Splunk SPL Query

index=proxy OR index=network sourcetype=http
| search (graylog OR src_process="java" OR dest_host="*graylog*")
| where match(status_code, "^(301|302|303|307|308)$")
| rex field=location "(?<redir_host>https?://[^/:]+)"
| lookup internal_ranges redir_host OUTPUT is_internal
| where is_internal=1 OR match(redir_host, "^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.0\.0\.1|169\.254\.169\.254)")
| stats count values(redir_host) as redirect_targets by src_ip, dest_host, status_code
| sort - count

Wazuh OSSEC Rule

<group name="graylog,ssrf,">
  <rule id="927890" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.(301|302|303|307|308)</field>
    <field name="location">(127\.0\.0\.1|169\.254\.169\.254|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)</field>
    <description>CVE-2026-92789: Graylog SSRF allowlist bypass via redirect to internal address</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_92789,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version metadata is available. Treat all Graylog deployments ≤ 7.1.4 as vulnerable until a patched release is published.

1) Immediate mitigations

• Restrict who can manage lookup tables and event notifications; remove or downgrade these permissions from non-administrative and low-trusted accounts (directly addresses the PR:L vector).
• Where possible, disable outbound HTTP data adapters and HTTP event notifications if not operationally required.
• Egress-filter the Graylog server: deny outbound requests to link-local metadata (169.254.169.254), loopback, and RFC1918 ranges unless explicitly required, and block redirect-following at the egress proxy.
• Deploy a forward/reverse proxy in front of Graylog that enforces the allowlist on every hop and does not auto-follow redirects, or that revalidates the Location target before connecting.

2) Patch / upgrade steps

• Monitor the Graylog release notes and security advisories for a version > 7.1.4 that addresses the redirect re-validation gap. No fixed version is confirmed at this time.
• Establish a change-control watch so the instance is upgraded immediately upon patch availability.

3) Long-term hardening

• Enforce SSRF defenses at the application and network layers: re-validate every redirect hop, off-host all outbound fetches through a dedicated egress control, and apply DNS-rebinding protections.
• Segment the Graylog server so that even a successful SSRF reaches a minimal set of internal services.
• Apply least-privilege access to all Graylog API features and continuously audit lookup/notification configurations for unexpected external or internal URLs.

References

• NVD — CVE-2026-92789: https://nvd.nist.gov/vuln/detail/CVE-2026-92789
• CWE-918: Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Graylog Security Advisories / Release Notes (monitor for a fix above 7.1.4): https://graylog.org/security/ (vendor security page)
• OWASP SSRF Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

Threat actor / exploit-in-the-wild evidence: None. No public PoC, Nuclei template, or exploit code is available; CVE-2026-92789 is not in CISA KEV. EPSS has not yet been scored by FIRST.org. All exploitation mechanics described are inferred solely from the vulnerability class stated in the NVD description.