CVE-2026-1441

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-1441

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1441.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-1441

Published

2026-02-18T13:14:11.570Z

Modified

2026-07-08T08:12:40.278877189Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface

Details

Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker to inject and execute arbitrary JavaScript code when a user visits a specially crafted URL. Exploitation of this vulnerability may allow script execution in the victim's browser and limited manipulation of the affected user's session context, through the '/system/index_sets/' endpoint.

Database specific

{
    "cna_assigner": "INCIBE",
    "cwe_ids": [
        "CWE-79"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.2.3"
                },
                {
                    "last_affected": "2.2.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1441.json"
}

References

Affected packages

Git / github.com/graylog2/graylog2-server

Affected ranges

Type

GIT

Repo

https://github.com/graylog2/graylog2-server

Events

Introduced

7adc951e40b9dcacc3bc60d2b51e8a5e976ca53b

Last affected

7adc951e40b9dcacc3bc60d2b51e8a5e976ca53b

Database specific

{
    "extracted_events": [
        {
            "introduced": "2.2.3"
        },
        {
            "last_affected": "2.2.3"
        }
    ],
    "cpe": "cpe:2.3:a:graylog:graylog:2.2.3:*:*:*:*:*:*:*",
    "source": "CPE_STRING"
}

Affected versions

2.*

2.2.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1441.json"