CVE-2018-8096: Datalust Seq authentication bypass via settings API grants admin access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no privileges or interaction required, public exploit code, and a high EPSS score make this an urgent patch for exposed Seq instances.

What it is

Datalust Seq before 4.2.605 allows an unauthenticated attacker to disable authentication by sending a PUT request to api/settings/setting-isauthenticationenabled with the value set to false. Because the setting controls whether authentication is enforced, the attacker can then reach the instance with administrative access. This is a critical flaw for any internet-exposed Seq deployment, as it removes the primary access control on the product.

Impact

An attacker gains full administrative control of the Seq instance, including access to log data and configuration, without needing valid credentials. From there they can read or alter stored telemetry and settings.

Attack surface

Reachable over the network through the Seq HTTP API; the CVSS vector shows no privileges and no user interaction required. Any host exposing the Seq web interface or API is a candidate target.

Exploitation

Not listed in CISA KEV, but public exploit code exists (Exploit-DB 45136 and a technical write-up) and EPSS is 0.48184 at the 98.8th percentile, indicating high likelihood of attempted exploitation.

What to do

• Upgrade Seq to 4.2.605 or later, which contains the fix referenced in the vendor ticket.
• If immediate patching is not possible, restrict network access to the Seq API and web interface to trusted hosts only.
• Verify that authentication is enabled in Seq settings and re-enable it if it has been disabled.
• Monitor Seq configuration changes and audit logs for unexpected modifications to authentication settings.
• Do not expose Seq directly to the internet; place it behind a reverse proxy or VPN with access controls.

Detection

• Alert on PUT requests to api/settings/setting-isauthenticationenabled, especially with a false value.
• Monitor Seq audit or application logs for authentication being disabled or settings changed outside maintenance windows.
• Review web server or proxy logs for unauthenticated access to Seq administrative endpoints.
• Check for unexpected administrative sessions or configuration changes originating from unfamiliar source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.