CVE-2026-1435: 
NixOS vulnerability analysis and mitigation

CVE-2026-1435 is an insufficient session expiration vulnerability in the Graylog Web Interface version 2.2.3, classified under CWE-613. The flaw stems from incorrect session invalidation logic: while the application generates a new sessionId upon each authentication, it fails to invalidate previously issued session identifiers, which remain valid indefinitely. This allows an attacker who obtains a leaked or stolen session token to reuse it for unauthorized access. The vulnerability was published on February 18, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (Feedly, CVE.org).

The root cause is CWE-613 (Insufficient Session Expiration): Graylog 2.2.3 issues a new session token on login but does not invalidate prior tokens, leaving them permanently valid. An attacker with network access to port 9000 (or the configured HTTP/S endpoint) who possesses any previously issued sessionId — obtained via interception, credential theft, or log exposure — can replay that token to authenticate API and web interface requests without valid credentials. No user interaction is required, and the attack complexity is low, making it trivially exploitable by any network-adjacent adversary (Feedly, INCIBE).

Successful exploitation grants an attacker full unauthorized access to the Graylog Web Interface and API, enabling high-impact compromise across confidentiality (access to log data, credentials, and sensitive infrastructure telemetry), integrity (modification of alerts, dashboards, and configurations), and availability (disruption of logging and monitoring pipelines). Because Graylog typically aggregates logs from across an organization's infrastructure, unauthorized access could expose sensitive operational data and facilitate lateral movement by revealing internal network topology, credentials, or security events (Feedly).

There is no public proof-of-concept exploit code and no confirmed in-the-wild exploitation as of the time of reporting (Feedly). The EPSS score is approximately 0.049%, reflecting a currently low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. However, the low attack complexity and lack of required privileges make this vulnerability straightforward to exploit if a session token is obtained.

1. Reconnaissance: Identify Graylog instances running version 2.2.3 exposed on port 9000 or via HTTP/S using network scanning tools (e.g., Shodan, Censys, or Nmap).
2. Session Token Acquisition: Obtain a valid sessionId through one of several means: network interception (e.g., HTTP traffic sniffing if TLS is not enforced), access to application logs, browser history, or credential theft from a compromised user endpoint.
3. Token Replay: Craft an HTTP request to the Graylog API or web interface (e.g., GET /api/system or any authenticated endpoint) and include the stolen sessionId in the Authorization header or session cookie.
4. Unauthorized Access: The server accepts the old session token as valid, granting full access to the Graylog interface — including log search, alert management, user administration, and API operations — without requiring the account's current credentials (Feedly, INCIBE).

• Network: Repeated authenticated API requests to port 9000 from unexpected or external IP addresses; HTTP requests using session tokens associated with users who are not actively logged in.
• Logs: Graylog access logs showing API calls authenticated with session tokens that were issued during prior login sessions (timestamps significantly predating the current session); multiple concurrent sessions for the same user from different source IPs.
• Behavioral: Unusual administrative actions (user creation, alert modification, dashboard changes) performed outside of normal business hours or from unfamiliar IP addresses; API queries for sensitive log streams not consistent with the user's normal activity pattern.

No official patch has been confirmed in the available data for Graylog 2.2.3; organizations should upgrade to a newer Graylog release that properly invalidates session identifiers upon logout and subsequent login (Feedly). As an immediate workaround, restrict network access to the Graylog Web Interface (port 9000) to trusted internal networks only using firewall rules or network segmentation. Implement mandatory session timeout policies and monitor for anomalous session activity. Consider adding an authentication proxy or requiring re-authentication for sensitive operations until a patched version is deployed.

The vulnerability received coverage from several security aggregation platforms and blogs shortly after its February 18, 2026 publication, including The Hacker Wire and CyberHub Blog, which highlighted it among high-CVSS CVEs published that day (The Hacker Wire, CyberHub Blog). A Bluesky post from The Hacker Wire also noted the vulnerability. No official statement from Graylog or significant researcher commentary beyond aggregation has been identified at this time.