CVE-2026-1440: 
NixOS vulnerability analysis and mitigation

CVE-2026-1440 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, specifically version 2.2.3. The flaw arises from insufficient sanitization and output encoding of URL segments included directly in HTML responses, enabling an attacker to inject and execute arbitrary JavaScript in a victim's browser. The vulnerability is exploitable via the /system/pipelines/ endpoint, among others. It was published on February 18, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Feedly, CVE.org).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Graylog 2.2.3 includes segments of the request URL directly in HTML output without applying output encoding, allowing attacker-controlled content to be rendered as executable JavaScript. Exploitation requires no authentication (PR:N) but does require user interaction — specifically, a victim must visit a specially crafted URL. The primary known vulnerable endpoint is /system/pipelines/, though multiple endpoints may be affected (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session within the Graylog web interface. This can lead to limited session manipulation, theft of session tokens or cookies, phishing via UI redirection, and unauthorized actions performed on behalf of the authenticated user. Confidentiality and integrity impacts are rated low; availability is not affected (Feedly, CVE.org).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2026-1440 as of the available data. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify publicly accessible Graylog instances running version 2.2.3 using tools like Shodan or Censys, searching for Graylog web interface banners.
2. Identify vulnerable endpoint: Target the /system/pipelines/ endpoint (or other endpoints that reflect URL segments in HTML responses without encoding).
3. Craft malicious URL: Construct a URL that injects a JavaScript payload into the URL path or parameter that will be reflected in the HTML response, e.g., https://<graylog-host>/system/pipelines/<script>alert(document.cookie)</script>.
4. Deliver the URL: Send the crafted URL to a target user (e.g., a Graylog administrator) via phishing email, chat message, or embedded link.
5. Achieve JavaScript execution: When the victim clicks the link and their browser renders the response, the injected script executes in the context of the Graylog web application, potentially stealing session tokens or performing actions on behalf of the victim (Feedly, CVE.org).

• Network: HTTP requests to Graylog endpoints (e.g., /system/pipelines/) containing URL-encoded JavaScript payloads (e.g., %3Cscript%3E, <script>, javascript:) in the path or query string.
• Logs: Graylog web server access logs showing GET requests to /system/pipelines/ with unusual or encoded characters in the URL path; referrer headers pointing to external or unexpected domains.
• Browser/Session: Unexpected outbound requests from victim browsers to attacker-controlled domains shortly after accessing Graylog URLs; anomalous API calls made under a legitimate user's session.

Users should upgrade Graylog beyond version 2.2.3 to a release that includes proper output encoding for URL-reflected content. As a workaround, restrict access to the Graylog web interface to trusted internal networks or VPN, reducing the attack surface for social engineering-based delivery of malicious URLs. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help detect and block reflected XSS payloads targeting Graylog endpoints (Feedly, INCIBE).