← Vulnerability feed

Vulnerability record · CVE-2024-52506 · published 18 November 2024

CVE-2024-52506: Graylog information exposure vulnerability

Graylog · Graylog

Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included in Graylog 6.1.0 & 6.1.1, is vulnerable to information leakage triggered by multiple concurrent report rendering requests from authorized users. When multiple report renderings are requested at the same start time, the headless browser instance used to render the PDF will be reused. Depending on the timing, either a check for the browser instance "freshness" hits, resulting in an error instead of the report being returned, or one of the concurrent report rendering requests "wins" and this report is returned for all report rendering requests that do not return an error. This might lead to one user getting the report of a different user, potentially leaking indexed log messages or aggregated data that this user normally has no access to. This problem is fixed in Graylog 6.1.2. There is no known workaround besides disabling the reporting functionality.

7.1 CVSS 4.0 High EPSS 0.63% · top 51.8% CWE-200 · Information exposure
7.1CVSS 4.0 base score
0.63%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included in Graylog 6.1.0 & 6.1.1, is vulnerable to information leakage triggered by multiple concurrent report rendering requests from authorized users. When multiple report renderings are requested at the same start time, the headless browser instance used to render the PDF will be reused. Depending on the timing, either a check for the browser instance "freshness" hits, resulting in an error instead of the report being returned, or one of the concurrent report rendering requests "wins" and this report is returned for all report rendering requests that do not return an error. This might lead to one user getting the report of a different user, potentially leaking indexed log messages or aggregated data that this user normally has no access to. This problem is fixed in Graylog 6.1.2. There is no known workaround besides disabling the reporting functionality.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-vggm-3478-vm5m PatchThird Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2024-52506-detect-graylog-vulnerability ExploitThird Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2024-52506-mitigate-graylog-vulnerability ExploitThird Party Advisory

Track CVE-2024-52506 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-37759Graylog sensitive information in log file vulnerabilityA Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID…EPSS 1.3%9.8CVE-2021-37760Graylog sensitive information in log file vulnerabilityA Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).EPSS 1.3%9.3CVE-2026-1435Graylog insufficient session expiration vulnerabilityNot properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new…EPSS 0.37%8.8CVE-2025-53106Graylog improper authorization vulnerabilityGraylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain …EPSS 0.59%8.8CVE-2024-24824Graylog improper access control vulnerabilityGraylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded…EPSS 35%8.1CVE-2020-15813Graylog improper certificate validation vulnerabilityGraylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connecti…EPSS 0.78%7.1CVE-2026-1436Graylog insecure direct object reference vulnerabilityImproper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can acces…EPSS 0.22%6.1CVE-2018-14380Graylog cross-site scripting vulnerabilityIn Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.t…EPSS 0.98%

Source: NIST National Vulnerability Database (record CVE-2024-52506), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.