CVE-2021-37759: Graylog

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).

Affected products

• Graylog Graylog: from 0.20.0, before 4.1.2 (fixed in 4.1.2)

Published 2021-07-31. Last modified 2026-06-17.