CVE-2026-44025
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Fluentd before version 1.19.3 has a vulnerability in the Monitor Agent plugin (in_monitor_agent) that unintentionally exposes internal instance variables in REST API responses. These variables may contain sensitive data such as database passwords, API keys, or cloud credentials.
Risk Assessment
The organization is at risk of leaking confidential credentials, which could lead to unauthorized access to external systems, databases, or cloud services.
Recommendation
Immediately update Fluentd to version 1.19.3 or later, which fixes this vulnerability.
Other vulnerabilities in Fluentd
See all- CVE-2026-44024Critical
Fluentd before version 1.19.3 allows dynamically constructing file paths using the ${tag} placeholder. Insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin lets attackers send untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution.
- CVE-2017-10906Critical
CVE-2017-10906 describes an escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40. This may allow an attacker to change the terminal UI or execute arbitrary commands on the device.
- CVE-2026-44161High
The out_http output plugin in Fluentd before version 1.19.3 allows placeholders like ${tag} in the endpoint configuration parameter. If the placeholder value comes from untrusted input, an attacker can control the destination hostname of outbound HTTP requests and force them to arbitrary internal services.
- CVE-2026-44160High
A vulnerability in Fluentd before version 1.19.3 allows a denial of service (DoS) attack via memory exhaustion. The in_http and in_forward plugins support gzip-compressed data but only enforce limits on the compressed payload size, allowing a crafted small compressed packet to decompress into an excessive amount of memory.
Original NVD description (English source)
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agent plugin in_monitor_agent exposes internal metrics and plugin information via a REST API, and responses from /api/plugins.json and related endpoints unintentionally include internal instance variables that may contain database passwords, API keys, or cloud credentials. This issue is fixed in version 1.19.3.