{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Gravwell 5.10.3 fixes six vulnerabilities found by Gravwell's internal security review: one Critical, four High and one Medium. Upgrade to 5.10.3 now.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Upgrade to Gravwell 5.10.3 (https://docs.gravwell.io/changelog/5.10.3.html).\n\nFor Docker deployments, pull the 5.10.3 gravwell images.\n\nThe 5.10.3 changelog also lists security fixes outside this advisory. Some of them need you to rotate credentials used by certain ingesters; follow the changelog.",
        "title": "Self-Hosted"
      },
      {
        "category": "general",
        "text": "No action required.",
        "title": "Gravwell Cloud"
      },
      {
        "category": "general",
        "text": "To give customers time to upgrade, Gravwell will publish the details of each vulnerability on 2026-11-05.",
        "title": "Details withheld"
      },
      {
        "category": "general",
        "text": "Gravwell has requested CVE IDs and will add them to this advisory as soon as they are assigned.",
        "title": "CVE IDs pending"
      },
      {
        "category": "legal_disclaimer",
        "text": "This advisory is provided as is. Scores are Gravwell's assessment of each vulnerability as it affects Gravwell.",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@gravwell.io",
      "name": "Gravwell",
      "namespace": "https://gravwell.io"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.gravwell.io/.well-known/csaf/white/2026/gvd-2026-0002.json"
      },
      {
        "category": "self",
        "summary": "Human-readable advisory",
        "url": "https://security.gravwell.io/advisories/GVD-2026-0002/"
      }
    ],
    "title": "Security fixes in Gravwell 5.10.3",
    "tracking": {
      "current_release_date": "2026-10-29T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "gvd"
        }
      },
      "id": "GVD-2026-0002",
      "initial_release_date": "2026-10-29T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-29T00:00:00.000Z",
          "number": "1",
          "summary": "Initial publication. Details withheld until 2026-11-05; CVE IDs will follow when assigned."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:semver/>=2.0.0|<5.10.3",
                "product": {
                  "name": "Gravwell >= 2.0.0, < 5.10.3",
                  "product_id": "GRAVWELL-GE-2.0.0-LT-5.10.3"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:semver/>=3.1.0|<5.10.3",
                "product": {
                  "name": "Gravwell >= 3.1.0, < 5.10.3",
                  "product_id": "GRAVWELL-GE-3.1.0-LT-5.10.3"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:semver/>=4.0.3|<5.10.3",
                "product": {
                  "name": "Gravwell >= 4.0.3, < 5.10.3",
                  "product_id": "GRAVWELL-GE-4.0.3-LT-5.10.3"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:semver/>=5.10.3",
                "product": {
                  "name": "Gravwell >= 5.10.3",
                  "product_id": "GRAVWELL-GE-5.10.3"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:semver/>=5.8.11|<5.10.3",
                "product": {
                  "name": "Gravwell >= 5.8.11, < 5.10.3",
                  "product_id": "GRAVWELL-GE-5.8.11-LT-5.10.3"
                }
              }
            ],
            "category": "product_name",
            "name": "Gravwell"
          }
        ],
        "category": "vendor",
        "name": "Gravwell"
      }
    ]
  },
  "vulnerabilities": [
    {
      "ids": [
        {
          "system_name": "Gravwell advisory",
          "text": "GVD-2026-0002/V1"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Gravwell 5.10.3 fixes six vulnerabilities found by Gravwell's internal security review: one Critical, four High and one Medium. Upgrade to 5.10.3 now.",
          "title": "Description"
        },
        {
          "category": "other",
          "text": "CVSS 4.0 base score 9.0 (Critical), CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
          "title": "CVSS 4.0"
        }
      ],
      "product_status": {
        "fixed": [
          "GRAVWELL-GE-5.10.3"
        ],
        "known_affected": [
          "GRAVWELL-GE-5.8.11-LT-5.10.3"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Upgrade to Gravwell 5.10.3 (https://docs.gravwell.io/changelog/5.10.3.html).\n\nFor Docker deployments, pull the 5.10.3 gravwell images.\n\nThe 5.10.3 changelog also lists security fixes outside this advisory. Some of them need you to rotate credentials used by certain ingesters; follow the changelog.",
          "product_ids": [
            "GRAVWELL-GE-5.8.11-LT-5.10.3"
          ],
          "url": "https://security.gravwell.io/advisories/GVD-2026-0002/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "GRAVWELL-GE-5.8.11-LT-5.10.3"
          ]
        }
      ]
    },
    {
      "ids": [
        {
          "system_name": "Gravwell advisory",
          "text": "GVD-2026-0002/V2"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Gravwell 5.10.3 fixes six vulnerabilities found by Gravwell's internal security review: one Critical, four High and one Medium. Upgrade to 5.10.3 now.",
          "title": "Description"
        },
        {
          "category": "other",
          "text": "CVSS 4.0 base score 8.5 (High), CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
          "title": "CVSS 4.0"
        }
      ],
      "product_status": {
        "fixed": [
          "GRAVWELL-GE-5.10.3"
        ],
        "known_affected": [
          "GRAVWELL-GE-4.0.3-LT-5.10.3"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Upgrade to Gravwell 5.10.3 (https://docs.gravwell.io/changelog/5.10.3.html).\n\nFor Docker deployments, pull the 5.10.3 gravwell images.\n\nThe 5.10.3 changelog also lists security fixes outside this advisory. Some of them need you to rotate credentials used by certain ingesters; follow the changelog.",
          "product_ids": [
            "GRAVWELL-GE-4.0.3-LT-5.10.3"
          ],
          "url": "https://security.gravwell.io/advisories/GVD-2026-0002/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "GRAVWELL-GE-4.0.3-LT-5.10.3"
          ]
        }
      ]
    },
    {
      "ids": [
        {
          "system_name": "Gravwell advisory",
          "text": "GVD-2026-0002/V3"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Gravwell 5.10.3 fixes six vulnerabilities found by Gravwell's internal security review: one Critical, four High and one Medium. Upgrade to 5.10.3 now.",
          "title": "Description"
        },
        {
          "category": "other",
          "text": "CVSS 4.0 base score 8.4 (High), CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
          "title": "CVSS 4.0"
        }
      ],
      "product_status": {
        "fixed": [
          "GRAVWELL-GE-5.10.3"
        ],
        "known_affected": [
          "GRAVWELL-GE-4.0.3-LT-5.10.3"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Upgrade to Gravwell 5.10.3 (https://docs.gravwell.io/changelog/5.10.3.html).\n\nFor Docker deployments, pull the 5.10.3 gravwell images.\n\nThe 5.10.3 changelog also lists security fixes outside this advisory. Some of them need you to rotate credentials used by certain ingesters; follow the changelog.",
          "product_ids": [
            "GRAVWELL-GE-4.0.3-LT-5.10.3"
          ],
          "url": "https://security.gravwell.io/advisories/GVD-2026-0002/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "GRAVWELL-GE-4.0.3-LT-5.10.3"
          ]
        }
      ]
    },
    {
      "ids": [
        {
          "system_name": "Gravwell advisory",
          "text": "GVD-2026-0002/V4"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Gravwell 5.10.3 fixes six vulnerabilities found by Gravwell's internal security review: one Critical, four High and one Medium. Upgrade to 5.10.3 now.",
          "title": "Description"
        },
        {
          "category": "other",
          "text": "CVSS 4.0 base score 8.3 (High), CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L",
          "title": "CVSS 4.0"
        }
      ],
      "product_status": {
        "fixed": [
          "GRAVWELL-GE-5.10.3"
        ],
        "known_affected": [
          "GRAVWELL-GE-2.0.0-LT-5.10.3"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Upgrade to Gravwell 5.10.3 (https://docs.gravwell.io/changelog/5.10.3.html).\n\nFor Docker deployments, pull the 5.10.3 gravwell images.\n\nThe 5.10.3 changelog also lists security fixes outside this advisory. Some of them need you to rotate credentials used by certain ingesters; follow the changelog.",
          "product_ids": [
            "GRAVWELL-GE-2.0.0-LT-5.10.3"
          ],
          "url": "https://security.gravwell.io/advisories/GVD-2026-0002/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "GRAVWELL-GE-2.0.0-LT-5.10.3"
          ]
        }
      ]
    },
    {
      "ids": [
        {
          "system_name": "Gravwell advisory",
          "text": "GVD-2026-0002/V5"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Gravwell 5.10.3 fixes six vulnerabilities found by Gravwell's internal security review: one Critical, four High and one Medium. Upgrade to 5.10.3 now.",
          "title": "Description"
        },
        {
          "category": "other",
          "text": "CVSS 4.0 base score 7.6 (High), CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSS 4.0"
        }
      ],
      "product_status": {
        "fixed": [
          "GRAVWELL-GE-5.10.3"
        ],
        "known_affected": [
          "GRAVWELL-GE-4.0.3-LT-5.10.3"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Upgrade to Gravwell 5.10.3 (https://docs.gravwell.io/changelog/5.10.3.html).\n\nFor Docker deployments, pull the 5.10.3 gravwell images.\n\nThe 5.10.3 changelog also lists security fixes outside this advisory. Some of them need you to rotate credentials used by certain ingesters; follow the changelog.",
          "product_ids": [
            "GRAVWELL-GE-4.0.3-LT-5.10.3"
          ],
          "url": "https://security.gravwell.io/advisories/GVD-2026-0002/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "GRAVWELL-GE-4.0.3-LT-5.10.3"
          ]
        }
      ]
    },
    {
      "ids": [
        {
          "system_name": "Gravwell advisory",
          "text": "GVD-2026-0002/V6"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Gravwell 5.10.3 fixes six vulnerabilities found by Gravwell's internal security review: one Critical, four High and one Medium. Upgrade to 5.10.3 now.",
          "title": "Description"
        },
        {
          "category": "other",
          "text": "CVSS 4.0 base score 6.2 (Medium), CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
          "title": "CVSS 4.0"
        }
      ],
      "product_status": {
        "fixed": [
          "GRAVWELL-GE-5.10.3"
        ],
        "known_affected": [
          "GRAVWELL-GE-3.1.0-LT-5.10.3"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Upgrade to Gravwell 5.10.3 (https://docs.gravwell.io/changelog/5.10.3.html).\n\nFor Docker deployments, pull the 5.10.3 gravwell images.\n\nThe 5.10.3 changelog also lists security fixes outside this advisory. Some of them need you to rotate credentials used by certain ingesters; follow the changelog.",
          "product_ids": [
            "GRAVWELL-GE-3.1.0-LT-5.10.3"
          ],
          "url": "https://security.gravwell.io/advisories/GVD-2026-0002/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "GRAVWELL-GE-3.1.0-LT-5.10.3"
          ]
        }
      ]
    }
  ]
}