CVE-2026-1435 is a session management flaw in the Graylog Web Interface, version 2.2.3, rated 9.8 (critical). The record says a new session ID is created at each login but earlier ones stay valid, so a stolen ID can be reused. The record names no fixed version, so check the notice and upgrade to a supported release.
What's affected
- Product: Graylog Web Interface.
- Affected: version 2.2.3, as named in the record.
- Fixed: the record does not list a fixed version. The reference is a Spanish national CERT notice about several Graylog vulnerabilities, which could not be loaded when this post was written. Check it and Graylog's release notes.
- Severity: 9.8 with the record's CWE-613 (insufficient session expiration). Not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
Check the Graylog version in the web interface footer or the system overview page. If it is 2.2.3, you are in scope.
You can also test the behavior safely on a non production instance with test accounts: sign in twice from different browsers and see whether the first session still works after the second login. If it does, old sessions are surviving.
Also check how widely the web interface is reachable. A log platform holds sensitive data, and it should not be on the open internet.
What to do now
- Find Graylog instances and record their versions.
- Upgrade to a current supported release. The 2.2.3 line is old, and a move forward brings many other fixes.
- Until then, restrict access to the web interface to a VPN or trusted network.
- Shorten session lifetimes where the product allows it, and force sign out by restarting the service after suspected exposure.
- Treat stored session IDs in proxy logs and browser tools as sensitive.
Why it matters
A session ID is a bearer token: whoever holds it acts as the user. Good session handling ends a session at logout, after a timeout, and when credentials change. CWE-613 covers the failure of that. Here, the record says a new ID is issued at each login while earlier IDs remain valid, so signing in again does not cut off a stolen session.
The score of 9.8 assumes the stolen ID gives full access. In a log management platform that can mean reading sensitive log data and changing configuration. The flaw depends on the ID leaking first, through a proxy log, a shared computer or similar. It does not let someone guess an ID.
Because the affected version is old, the practical answer is not a patch hunt but an upgrade, along with tighter network access.
Quick check
Is there a fixed version?
The record does not list one. Check Graylog's release notes and the national CERT notice referenced by the record.
How would a session ID leak?
The record only says a stolen or leaked ID can be reused. Common sources are logs, shared devices and intercepted traffic.
Sources
Last reviewed: 19 October 2026.
