CVE-2023-41041
CVE-2023-41041 is a low-severity vulnerability in Graylog with a CVSS 3.x base score of 2.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-613.
Key facts
- Severity: Low (CVSS 3.x base score 2.6)
- EPSS exploit prediction: 0% (33rd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-613
- Affected product: Graylog
- Published:
- Last modified:
Description
Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Each node maintains an in-memory cache of user sessions. Upon a cache-miss, the session is loaded from the database. After that, the node operates solely on the cached session. Modifications to sessions will update the cached version as well as the session persisted in the database. However, each node maintains their isolated version of the session. When the user logs out, the session is removed from the node-local cache and deleted from the database. The other nodes will however still use the cached session. These nodes will only fail to accept the session id if they intent to update the session in the database. They will then notice that the session is gone. This is true for most API requests originating from user interaction with the Graylog UI because these will lead to an update of the session's "last access" timestamp. If the session update is however prevented by setting the `X-Graylog-No-Session-Extension:true` header in the request, the node will consider the (cached) session valid until the session is expired according to its timeout setting. No session identifiers are leaked. After a user has logged out, the UI shows the login screen again, which gives the user the impression that their session is not valid anymore. However, if the session becomes compromised later, it can still be used to perform API requests against the Graylog cluster. The time frame for this is limited to the configured session lifetime, starting from the time when the user logged out. This issue has been addressed in versions 5.0.9 and 5.1.3. Users are advised to upgrade.
Frequently asked questions
- What is CVE-2023-41041?
- Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Each node maintains an in-memory cache of user sessions. Upon a cache-miss, the session is loaded from the database. After that, the node operates solely on the cached session. Modifications to sessions will update the cached version as well as the session persisted in the database. However, each node maintains their isolated version of the session. When the user logs out, the session is removed from the node-local cache and deleted from the database. The other nodes will however still use the cached session. These nodes will only fail to accept the session id if they intent to update the session in the database. They will then notice that the session is gone. This is true for most API requests originating from user interaction with the Graylog UI because these will lead to an update of the session's "last access" timestamp. If the session update is however prevented by setting the `X-Graylog-No-Session-Extension:true` header in the request, the node will consider the (cached) session valid until the session is expired according to its timeout setting. No session identifiers are leaked. After a user has logged out, the UI shows the login screen again, which gives the user the impression that their session is not valid anymore. However, if the session becomes compromised later, it can still be used to perform API requests against the Graylog cluster. The time frame for this is limited to the configured session lifetime, starting from the time when the user logged out. This issue has been addressed in versions 5.0.9 and 5.1.3. Users are advised to upgrade.
- How severe is CVE-2023-41041?
- CVE-2023-41041 has a CVSS 3.x base score of 2.6, rated low severity. It is exploitable over network with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.
- Is CVE-2023-41041 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-41041?
- CVE-2023-41041 affects Graylog. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2023-41041?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2023-41041 published?
- CVE-2023-41041 was published on 2023-08-30 and last updated on 2026-06-17.
References
- https://github.com/Graylog2/graylog2-server/commit/bb88f3d0b2b0351669ab32c60b595ab7242a3fe3
- https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-3fqm-frhg-7c85
Affected products (1)
- cpe:2.3:a:graylog:graylog:*:*:*:*:*:*:*:*
More vulnerabilities in Graylog
- CVE-2026-1435 — Critical (CVSS 9.8): Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of…
- CVE-2021-37760 — Critical (CVSS 9.8): A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level…
- CVE-2021-37759 — Critical (CVSS 9.8): A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access…
- CVE-2025-53106 — High (CVSS 8.8): Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before…
- CVE-2024-24824 — High (CVSS 8.8): Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4,…
- CVE-2020-15813 — High (CVSS 8.1): Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group…
Other CWE-613 (Insufficient Session Expiration) vulnerabilities
- CVE-2024-8888 — Critical (CVSS 10.0): An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the…
- CVE-2026-46455 — Critical (CVSS 9.8): Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper…
- CVE-2026-21622 — Critical (CVSS 9.8): Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module)…
- CVE-2025-59786 — Critical (CVSS 9.8): 2N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to…
- CVE-2026-26342 — Critical (CVSS 9.8): Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token…
- CVE-2026-1435 — Critical (CVSS 9.8): Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of…
Browse all CWE-613 (Insufficient Session Expiration) vulnerabilities →