Log in Start free

Vulnerability · Published Jul 2, 2025 · Assigned by GitHub_M

CVE-2025-53106Graylog vulnerable to privilege escalation through API tokens

High 8.8

In plain English

A high-severity security flaw in graylog2-server from Graylog2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.8High
Exploit odds (30 days)0.6%top 50.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID. For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation. This issue has been patched in versions 6.2.4 and 6.3.0-rc.2. A workaround involves disabling the respective configuration found in System > Configuration > Users > "Allow users to create personal access tokens".

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.graylog2:graylog2-server6.2.4GHSA-3m86-c9x3-vwm9
Mavenorg.graylog2:graylog2-server6.3.0-rc.2GHSA-3m86-c9x3-vwm9

Affected products (as reported)

VendorProductVersions
Graylog2 graylog2-server >= 6.2.0, < 6.2.4>= 6.3.0-alpha.1, < 6.3.0-rc.2

Weakness: CWE-285 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References