CVE-2026-1441: 
NixOS vulnerability analysis and mitigation

CVE-2026-1441 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, specifically affecting version 2.2.3. The flaw arises from insufficient sanitization and output encoding of URL segments included directly in HTML responses, enabling an attacker to inject and execute arbitrary JavaScript in a victim's browser. The vulnerability was published on February 18, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Feedly).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Multiple endpoints in the Graylog Web Interface include raw URL path segments directly in HTML output without applying output encoding, allowing attacker-controlled content to be rendered as executable script. The specifically identified vulnerable endpoint is /system/index_sets/, where a crafted URL path can inject arbitrary JavaScript that executes in the context of the authenticated user's browser session (Feedly). No authentication is required by the attacker, but user interaction (visiting a malicious link) is necessary for exploitation.

Successful exploitation allows an attacker to execute arbitrary JavaScript code in the victim's browser within the context of the Graylog web application. This can result in limited confidentiality and integrity impacts, including session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, and manipulation of the user's session context. Availability is not directly impacted, and the scope is changed (affecting the user's browser environment beyond the vulnerable component) (Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1441 as of the available data. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify publicly accessible Graylog instances running version 2.2.3 using search engines (e.g., Shodan, Censys) or by probing known Graylog web interface ports.
2. Craft malicious URL: Construct a URL targeting the vulnerable /system/index_sets/ endpoint with a JavaScript payload embedded in the URL path segment, e.g., https://<graylog-host>/system/index_sets/<script>alert(document.cookie)</script>.
3. Deliver the link: Send the crafted URL to a target user (e.g., a Graylog administrator) via phishing email, chat message, or other social engineering vector.
4. Trigger execution: When the victim clicks the link and their browser loads the page, the Graylog server reflects the unencoded URL segment into the HTML response, causing the injected JavaScript to execute in the victim's browser session.
5. Achieve objective: The attacker's script can steal session cookies, capture credentials, perform actions on behalf of the victim within Graylog, or redirect the user to a malicious site (Feedly).

• Network: HTTP requests to /system/index_sets/ containing URL-encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, javascript:) in the path segment; unexpected outbound connections from the victim's browser to attacker-controlled domains following Graylog page loads.
• Logs: Graylog web server access logs showing GET requests to /system/index_sets/ with anomalous or encoded characters in the path; repeated requests from the same source IP with varying payloads.
• Browser/Session: Unexpected session invalidation or privilege escalation events in Graylog audit logs; user accounts performing unusual administrative actions shortly after accessing a suspicious URL.

Users should upgrade Graylog to a version beyond 2.2.3 that includes proper output encoding for URL segments in HTML responses. As a workaround, restrict access to the Graylog web interface to trusted networks or VPN-only access to reduce the attack surface. Additionally, educate users — particularly administrators — to avoid clicking unsolicited links to the Graylog interface. Implementing a Content Security Policy (CSP) header on the Graylog web interface can further mitigate the impact of XSS exploitation (Feedly).