Threats tagged 'ghsa-pgwr-3c66-c473'

CVE-2026-92789 is a Server-Side Request Forgery (SSRF) vulnerability in Graylog2 graylog2-server versions up to 7.1.4. The software validates outbound URLs against an allowlist before making requests but does not re-validate URLs after following HTTP redirects. This allows attackers with lookup table or event notification permissions to craft allowlisted endpoints that redirect to internal services, causing the server to fetch and return internal responses.