Graylog2 graylog2-server versions up to 7.1.4 implement an allowlist check for outbound URLs before making requests. However, the validation is bypassed after HTTP redirects because the server does not re-validate the redirected URLs. Attackers with certain permissions (lookup table or event notification) can exploit this by creating allowlisted endpoints that redirect to internal network services. This results in the server fetching and returning responses from internal services, effectively enabling SSRF.

An attacker with lookup table or event notification permissions can exploit this vulnerability to make the Graylog server perform unauthorized requests to internal services. This can lead to information disclosure from internal network resources that are otherwise inaccessible externally. The vulnerability has a CVSS 4.0 base score of 7.1 (high severity), indicating significant risk but requiring some level of privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions to lookup table and event notification features to trusted users only. Monitor for unusual outbound requests and consider network-level controls to limit server access to internal services.