GVD-2026-0002 · First Party advisory
Security fixes in Gravwell 5.10.3
What you need to do
Self-Hosted
Upgrade to Gravwell 5.10.3.
For Docker deployments, pull the 5.10.3 gravwell images.
The 5.10.3 changelog also lists security fixes outside this advisory. Some of them need you to rotate credentials used by certain ingesters; follow the changelog.
Gravwell Cloud
No action required.
Vulnerabilities
Details withheld until Thursday, 2026-11-05. To give customers time to upgrade, we will publish the details of each vulnerability on that date.
CVE IDs pending. We have requested CVE IDs and will add them to this advisory as soon as they are assigned.
| Identifier | Severity | CVSS 4.0 | CWE | Status | Fixed in |
|---|---|---|---|---|---|
| V1 | Critical | 9.0 | — | Fixed | 5.10.3 |
| V2 | High | 8.5 | — | Fixed | 5.10.3 |
| V3 | High | 8.4 | — | Fixed | 5.10.3 |
| V4 | High | 8.3 | — | Fixed | 5.10.3 |
| V5 | High | 7.6 | — | Fixed | 5.10.3 |
| V6 | Medium | 6.2 | — | Fixed | 5.10.3 |
V1
- Status
- Fixed
- Affected versions
- >= 5.8.11, < 5.10.3
- Fixed in
- 5.10.3
Scores
- CVSS 4.0
- 9.0 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
V2
- Status
- Fixed
- Affected versions
- >= 4.0.3, < 5.10.3
- Fixed in
- 5.10.3
Scores
- CVSS 4.0
- 8.5 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H - CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
V3
- Status
- Fixed
- Affected versions
- >= 4.0.3, < 5.10.3
- Fixed in
- 5.10.3
Scores
- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H - CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
V4
- Status
- Fixed
- Affected versions
- >= 2.0.0, < 5.10.3
- Fixed in
- 5.10.3
Scores
- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L - CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L
V5
- Status
- Fixed
- Affected versions
- >= 4.0.3, < 5.10.3
- Fixed in
- 5.10.3
Scores
- CVSS 4.0
- 7.6 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
V6
- Status
- Fixed
- Affected versions
- >= 3.1.0, < 5.10.3
- Fixed in
- 5.10.3
Scores
- CVSS 4.0
- 6.2 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N - CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Summary
Gravwell 5.10.3 fixes six vulnerabilities found by Gravwell’s internal security review: one Critical, four High and one Medium. Upgrade to 5.10.3 now.
Changelog
- Initial publication. Details withheld until 2026-11-05; CVE IDs will follow when assigned.