CVE-2021-37759

CVE-2021-37759 is a critical session ID leak vulnerability in Graylog versions prior to 4.1.2, where session IDs are inadvertently written to DEBUG log files. This flaw allows unauthenticated attackers to gain unauthorized access and escalate privileges to the level of the compromised session. With a CVSS score of 9.8 (CRITICAL), it presents a severe risk due to its network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.