CVE-2021-37760: Graylog

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).

Affected products

• Graylog Graylog: from 2.1.1, before 4.1.2 (fixed in 4.1.2)

Published 2021-07-31. Last modified 2026-06-17.