CVE-2026-44024
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
Fluentd before version 1.19.3 allows dynamically constructing file paths using the ${tag} placeholder. Insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin lets attackers send untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution.
Risk Assessment
The organization is at risk of remote code execution (RCE) and unauthorized writing or overwriting of critical system files, which could lead to server compromise and data integrity violations.
Recommendation
Immediately upgrade Fluentd to version 1.19.3 or later, which includes a fix that eliminates the vulnerability to file path attacks.
Other vulnerabilities in Fluentd
See all- CVE-2017-10906Critical
CVE-2017-10906 describes an escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40. This may allow an attacker to change the terminal UI or execute arbitrary commands on the device.
- CVE-2026-44161High
The out_http output plugin in Fluentd before version 1.19.3 allows placeholders like ${tag} in the endpoint configuration parameter. If the placeholder value comes from untrusted input, an attacker can control the destination hostname of outbound HTTP requests and force them to arbitrary internal services.
- CVE-2026-44160High
A vulnerability in Fluentd before version 1.19.3 allows a denial of service (DoS) attack via memory exhaustion. The in_http and in_forward plugins support gzip-compressed data but only enforce limits on the compressed payload size, allowing a crafted small compressed packet to decompress into an excessive amount of memory.
- CVE-2026-44025High
Fluentd before version 1.19.3 has a vulnerability in the Monitor Agent plugin (in_monitor_agent) that unintentionally exposes internal instance variables in REST API responses. These variables may contain sensitive data such as database passwords, API keys, or cloud credentials.
Original NVD description (English source)
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution. This issue is fixed in version 1.19.3.