# GVD-2026-0002: Security fixes in Gravwell 5.10.3

| | |
|---|---|
| Advisory | GVD-2026-0002 |
| Kind | First Party |
| Severity | Critical |
| Published | 2026-10-29 |
| Last updated | 2026-10-29 |
| Fixed in | 5.10.3 |
| CSAF | https://security.gravwell.io/.well-known/csaf/white/2026/gvd-2026-0002.json |
| Web page | https://security.gravwell.io/advisories/GVD-2026-0002/ |

## What you need to do

### Self-Hosted

Upgrade to [Gravwell 5.10.3](https://docs.gravwell.io/changelog/5.10.3.html).

For Docker deployments, pull the 5.10.3 gravwell images.

The 5.10.3 changelog also lists security fixes outside this advisory. Some of them need you to rotate credentials
used by certain ingesters; follow the changelog.

### Gravwell Cloud

No action required.

## Vulnerabilities

> **Details withheld until Thursday, 2026-11-05.** To give customers time to upgrade, we will publish the details of each vulnerability on that date.

> **CVE IDs pending.** We have requested CVE IDs and will add them to this advisory as soon as they are assigned.

| Identifier | Severity | CVSS 4.0 | CWE | Status | Fixed in |
|---|---|---|---|---|---|
| V1 | Critical | 9.0 | - | Fixed | 5.10.3 |
| V2 | High | 8.5 | - | Fixed | 5.10.3 |
| V3 | High | 8.4 | - | Fixed | 5.10.3 |
| V4 | High | 8.3 | - | Fixed | 5.10.3 |
| V5 | High | 7.6 | - | Fixed | 5.10.3 |
| V6 | Medium | 6.2 | - | Fixed | 5.10.3 |

### V1

- Status: Fixed
- Affected versions: >= 5.8.11, < 5.10.3
- Fixed in: 5.10.3
- CVSS 4.0: 9.0 Critical, `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
- CVSS 3.1: 9.9 Critical, `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

### V2

- Status: Fixed
- Affected versions: >= 4.0.3, < 5.10.3
- Fixed in: 5.10.3
- CVSS 4.0: 8.5 High, `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H`
- CVSS 3.1: 9.6 Critical, `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H`

### V3

- Status: Fixed
- Affected versions: >= 4.0.3, < 5.10.3
- Fixed in: 5.10.3
- CVSS 4.0: 8.4 High, `CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H`
- CVSS 3.1: 8.7 High, `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H`

### V4

- Status: Fixed
- Affected versions: >= 2.0.0, < 5.10.3
- Fixed in: 5.10.3
- CVSS 4.0: 8.3 High, `CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L`
- CVSS 3.1: 7.6 High, `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L`

### V5

- Status: Fixed
- Affected versions: >= 4.0.3, < 5.10.3
- Fixed in: 5.10.3
- CVSS 4.0: 7.6 High, `CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N`
- CVSS 3.1: 7.1 High, `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L`

### V6

- Status: Fixed
- Affected versions: >= 3.1.0, < 5.10.3
- Fixed in: 5.10.3
- CVSS 4.0: 6.2 Medium, `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N`
- CVSS 3.1: 8.7 High, `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N`

## Summary

Gravwell 5.10.3 fixes six vulnerabilities found by Gravwell's internal security review: one Critical, four High and
one Medium. Upgrade to 5.10.3 now.

## Changelog

- 2026-10-29: Initial publication. Details withheld until 2026-11-05; CVE IDs will follow when assigned.

Questions this advisory doesn't answer? Email the Gravwell Security Team at security@gravwell.io.