CVE-2026-1437: 
NixOS vulnerability analysis and mitigation

CVE-2026-1437 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, specifically version 2.2.3. The flaw arises from a lack of proper sanitization and output encoding, where several endpoints include URL segments directly in HTML responses without escaping. The primary affected endpoint is /system/authentication/users/edit/. It was published on February 18, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Feedly).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Multiple endpoints in the Graylog 2.2.3 web interface reflect portions of the request URL directly into HTML responses without applying output encoding, enabling an attacker to craft a malicious URL containing injected JavaScript. When a victim visits the crafted URL, the browser executes the injected script in the context of the Graylog web application. No authentication is required on the attacker's side, but user interaction (victim clicking the link) is necessary (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the Graylog web application's origin. This can lead to limited session manipulation, theft of session tokens or cookies, phishing within the application context, and unauthorized actions performed on behalf of the authenticated victim. Availability is not impacted, but both confidentiality and integrity are affected at a low level (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2026-1437 as of the available data. The EPSS score is approximately 0.044%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify publicly accessible Graylog 2.2.3 web interface instances, particularly those exposing the /system/authentication/users/edit/ endpoint.
2. Craft malicious URL: Construct a URL targeting the vulnerable endpoint with an XSS payload injected into the URL path or parameter that will be reflected in the HTML response without encoding, e.g., https://<graylog-host>/system/authentication/users/edit/<script>alert(document.cookie)</script>.
3. Deliver the URL: Send the crafted URL to a target user (e.g., a Graylog administrator) via phishing email, chat message, or other social engineering means.
4. Victim visits URL: When the authenticated victim clicks the link, their browser loads the Graylog page, which reflects the injected script into the HTML response.
5. JavaScript execution: The browser executes the injected JavaScript in the Graylog application's origin, potentially exfiltrating session tokens, performing actions on behalf of the victim, or displaying a phishing overlay (Feedly).

• Network: HTTP requests to /system/authentication/users/edit/ containing URL-encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=) in the path or query string.
• Logs: Graylog web server access logs showing GET requests to the /system/authentication/users/edit/ endpoint with anomalous, non-alphanumeric characters or encoded payloads in the URL.
• Browser/Client: Unexpected JavaScript alerts, redirects, or outbound requests to external domains originating from the Graylog web interface session.

Users should upgrade Graylog to a version beyond 2.2.3 that includes proper output encoding and input sanitization for all web interface endpoints. As a workaround, restrict access to the Graylog web interface to trusted internal networks or VPN, reducing the attack surface for reflected XSS delivery. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help detect and block crafted URLs before they reach users (Feedly).