Every CVE Search/ Get API key

CVE-2025-30373

Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value

6.5 MediumFix available

Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless. To mitigate the vulnerability, disable http-based inputs and allow only authenticated pull-based inputs. This vulnerability is fixed in 6.1.9.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.34%Up 0.3 points since Apr 8, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.5

Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value

Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless. To mitigate the vulnerability, disable http-based inputs and allow only authenticated pull-based inputs. This vulnerability is fixed in 6.1.9.

Record
CVE-2025-30373
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-285
Updated
2026-11-02
EUVDEUVD-2025-10045 6.5

Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless. To mitigate the vulnerability, disable http-based inputs and allow only authenticated pull-based inputs. This vulnerability is fixed in 6.1.9.

Record
EUVD-2025-10045
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-q7g5-jq6p-6wvx 6.5

Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value

Impact

Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless.

Patches

Workarounds

Disabling http-based inputs and allow only authenticated pull-based inputs.

Analysis provided by Fabian Yamaguchi - Whirly Labs (Pty) Ltd

Record
GHSA-q7g5-jq6p-6wvx
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-285
Updated
2026-11-02
NVD 6.5

Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless. To mitigate the vulnerability, disable http-based inputs and allow only authenticated pull-based inputs. This vulnerability is fixed in 6.1.9.

Record
CVE-2025-30373
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-285
Updated
2026-11-02
OSV 6.5

Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value

Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless. To mitigate the vulnerability, disable http-based inputs and allow only authenticated pull-based inputs. This vulnerability is fixed in 6.1.9.

Record
CVE-2025-30373
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-285
Updated
2026-11-02
OSVGHSA-q7g5-jq6p-6wvx 6.5

Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value

Impact

Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless.

Patches

Workarounds

Disabling http-based inputs and allow only authenticated pull-based inputs.

Analysis provided by Fabian Yamaguchi - Whirly Labs (Pty) Ltd

Record
GHSA-q7g5-jq6p-6wvx
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-285
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.graylog2:graylog2-server
Maven
 6.1.0 up to 6.1.9
6.1.9
org.graylog2:graylog2-server
Maven
 6.1.0 up to 6.1.9, plus listed versions
6.1.16.1.26.1.46.1.56.1.66.1.76.1.8
6.1.9

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-30373 is a medium vulnerability (CVSS 6.5) in Graylog, published April 7, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in org.graylog2:graylog2-server 6.1.9.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open