CVE-2026-1435: Incorrect management of session invalidation vulnerability in Graylog Web Interface

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-18 · updated 2026-06-17
Weakness: CWE-613

Description

Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. The application generates a new 'sessionId' each time a user authenticates, but does not invalidate previously issued session identifiers, which remain valid even after multiple consecutive logins by the same user. As a result, a stolen or leaked 'sessionId' can continue to be used to authenticate valid requests. Exploiting this vulnerability would allow an attacker with access to the web service/API network (port 9000 or HTTP/S endpoint of the server) to reuse an old session token to gain unauthorized access to the application, interact with the API/web, and compromise the integrity of the affected account.

Affected products

graylog2-server: 2.2.3

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-graylog

Get alerted when CVE-2026-1435 or the next vulnerability affects your stack