Graylog 5.1.13 → 7.2.1
106 releases · 0 breaking changes · 18 security fixes · 6 advisories fixed
18security0breaking0deprecated0feature0fix
Vulnerabilities fixed by this upgrade
- 7.2 GHSA-w9wq-g358-3x8g Privilege escalation via user creation and user permission/role updates
- 5.3 GHSA-vpqc-v737-94g9 Palo Alto Networks input parser can be exploited to consume excessive CPU and delay message processing
- 7.5 GHSA-xwgc-q8x5-538w IPFIX input parser can be exploited to consume excessive CPU and block message processing
- 7.5 CVE-2026-55841 Fortigate syslog message parser can be exploited to modify or delete fields from the original message
- 7.3 GHSA-q9q2-3ppx-mwqf Stored Cross-Site Scripting via Files Plugin and API Browser
- 8.0 CVE-2025-46827 Session Takeover via Insufficient HTML Sanitization
Breaking changes
None in the release notes.
Security changes
- security Fixes GHSA-w9wq-g358-3x8g: Privilege escalation via user creation and user permission/role updates in 7.1.9
- security Fixes CVE-2026-69190: Manager-to-Owner privilege escalation on saved searches and dashboards in 7.1.4
- security Fixes CVE-2026-55841: Fortigate syslog message parser can be exploited to modify or delete fields from the original message in 7.1.2
- security Fixes CVE-2026-55867: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens in 7.1.2
- security Fixes GHSA-w9wq-g358-3x8g: Privilege escalation via user creation and user permission/role updates in 7.0.13
- security Fixes CVE-2026-69190: Manager-to-Owner privilege escalation on saved searches and dashboards in 7.0.9
- security Fixes CVE-2026-55841: Fortigate syslog message parser can be exploited to modify or delete fields from the original message in 7.0.7
- security Fixes CVE-2026-55867: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens in 7.0.7
- security Fixes CVE-2026-69190: Manager-to-Owner privilege escalation on saved searches and dashboards in 7.0.0
- security Fixes CVE-2026-55867: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens in 7.0.0
- security Fixes CVE-2026-69190: Manager-to-Owner privilege escalation on saved searches and dashboards in 6.3.14
- security Fixes CVE-2026-55841: Fortigate syslog message parser can be exploited to modify or delete fields from the original message in 6.3.12
- security Fixes CVE-2026-55867: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens in 6.3.12
- security Fixes CVE-2025-53106: Privilege escalation through API tokens in 6.2.4
- security Fixes GHSA-q9q2-3ppx-mwqf: Stored Cross-Site Scripting via Files Plugin and API Browser in 6.2.0
- security Fixes CVE-2025-30373: Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value in 6.1.9
- security Fixes CVE-2024-24823: Session fixation vulnerability through cookie injection in 5.2.4
- security Fixes CVE-2024-24824: Instantiation of arbitrary classes triggered by API request in 5.2.4
Every release in between
securityFixes GHSA-w9wq-g358-3x8g: Privilege escalation via user creation and user permission/role updates
securityFixes CVE-2026-69190: Manager-to-Owner privilege escalation on saved searches and dashboards
securityFixes CVE-2026-55841: Fortigate syslog message parser can be exploited to modify or delete fields from the original message
securityFixes CVE-2026-55867: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens
securityFixes GHSA-w9wq-g358-3x8g: Privilege escalation via user creation and user permission/role updates
securityFixes CVE-2026-69190: Manager-to-Owner privilege escalation on saved searches and dashboards
securityFixes CVE-2026-55841: Fortigate syslog message parser can be exploited to modify or delete fields from the original message
securityFixes CVE-2026-55867: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens
securityFixes CVE-2026-69190: Manager-to-Owner privilege escalation on saved searches and dashboards
securityFixes CVE-2026-55867: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens
securityFixes CVE-2026-69190: Manager-to-Owner privilege escalation on saved searches and dashboards
securityFixes CVE-2026-55841: Fortigate syslog message parser can be exploited to modify or delete fields from the original message
securityFixes CVE-2026-55867: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens
securityFixes CVE-2025-53106: Privilege escalation through API tokens
securityFixes GHSA-q9q2-3ppx-mwqf: Stored Cross-Site Scripting via Files Plugin and API Browser
securityFixes CVE-2025-30373: Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value
securityFixes CVE-2024-24823: Session fixation vulnerability through cookie injection
securityFixes CVE-2024-24824: Instantiation of arbitrary classes triggered by API request