Description
Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker to inject and execute arbitrary JavaScript code when a user visits a specially crafted URL. Exploitation of this vulnerability may allow script execution in the victim's browser and limited manipulation of the affected user's session context, through the  '/system/index_sets/' endpoint.
Published: 2026-02-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Patch
AI Analysis

Impact

The vulnerability is a reflected XSS flaw in the Graylog Web Interface console, specifically the /system/index_sets/ endpoint of version 2.2.3. It arises because user‑supplied URL components are inserted into the HTML response without proper encoding. An attacker can embed and execute arbitrary JavaScript when a victim follows a crafted link, allowing the execution of scripts in the victim’s browser and limited temptation of the session context. The weakness conforms to CWE‑79, a classic input‑output validation issue.

Affected Systems

Graylog’s Web Interface, version 2.2.3, is affected. All earlier releases are considered obsolete by the vendor and contain the same flaw.

Risk and Exploitability

The CVSS base score is 5.3, indicating a moderate risk level. The EPSS score is below 1 %, suggesting a very low exploitation probability at present, and the flaw is not listed in the CISA KEV catalog. Exploitation requires a user to click a specially crafted URL, so the attack vector is remote browser abuse, with no requirement for elevated privileges. Considering the low EPSS and absence from KEV, the overall risk is moderate, but patching is still recommended to eliminate the XSS vector.

Generated by OpenCVE AI on April 18, 2026 at 11:59 UTC.

Remediation

Vendor Solution

It is recommended to update the software to the latest version, where the vulnerability described has already been mitigated. For the affected version, the vulnerability is not mitigated, as the manufacturer considers all versions prior to the current one to be obsolete.

OpenCVE Recommended Actions

  • Upgrade Graylog to the latest release, which contains the XSS patch and considers older versions obsolete.
  • Ensure the deployed version is later than 2.2.3 so that the output‑encoding fix is in place.
  • If an upgrade is not immediately possible, restrict access to the /system/index_sets/ endpoint to trusted users or quarantine the instance from public access to reduce the likelihood that a victim clicks a malicious link.

Generated by OpenCVE AI on April 18, 2026 at 11:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 18 Feb 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Graylog graylog
CPEs cpe:2.3:a:graylog:graylog:2.2.3:*:*:*:*:*:*:*
Vendors & Products Graylog graylog
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Wed, 18 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 18 Feb 2026 13:45:00 +0000

Type Values Removed Values Added
Description Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker to inject and execute arbitrary JavaScript code when a user visits a specially crafted URL. Exploitation of this vulnerability may allow script execution in the victim's browser and limited manipulation of the affected user's session context, through the  '/system/index_sets/' endpoint.
Title Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface
First Time appeared Graylog
Graylog graylog Web Interface
Weaknesses CWE-79
CPEs cpe:2.3:a:graylog:graylog_web_interface:2.2.3:*:*:*:*:*:*:*
Vendors & Products Graylog
Graylog graylog Web Interface
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Graylog Graylog Graylog Web Interface
cve-icon MITRE

Status: PUBLISHED

Assigner: INCIBE

Published:

Updated: 2026-02-18T14:12:52.186Z

Reserved: 2026-01-26T13:21:06.202Z

Link: CVE-2026-1441

cve-icon Vulnrichment

Updated: 2026-02-18T14:11:57.744Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-18T14:16:06.590

Modified: 2026-02-18T20:20:16.823

Link: CVE-2026-1441

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T12:00:05Z

Weaknesses