CVE-2026-44161
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
The out_http output plugin in Fluentd before version 1.19.3 allows placeholders like ${tag} in the endpoint configuration parameter. If the placeholder value comes from untrusted input, an attacker can control the destination hostname of outbound HTTP requests and force them to arbitrary internal services.
Risk Assessment
The risk involves potential SSRF (Server-Side Request Forgery) attacks, which could lead to unauthorized access to internal systems, data leakage, or privilege escalation within the infrastructure.
Recommendation
Immediately upgrade Fluentd to version 1.19.3 or later, which fixes this vulnerability. Additionally, restrict the use of placeholders in the endpoint configuration to trusted sources.
Other vulnerabilities in Fluentd
See all- CVE-2026-44024Critical
Fluentd before version 1.19.3 allows dynamically constructing file paths using the ${tag} placeholder. Insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin lets attackers send untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution.
- CVE-2017-10906Critical
CVE-2017-10906 describes an escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40. This may allow an attacker to change the terminal UI or execute arbitrary commands on the device.
- CVE-2026-44160High
A vulnerability in Fluentd before version 1.19.3 allows a denial of service (DoS) attack via memory exhaustion. The in_http and in_forward plugins support gzip-compressed data but only enforce limits on the compressed payload size, allowing a crafted small compressed packet to decompress into an excessive amount of memory.
- CVE-2026-44025High
Fluentd before version 1.19.3 has a vulnerability in the Monitor Agent plugin (in_monitor_agent) that unintentionally exposes internal instance variables in REST API responses. These variables may contain sensitive data such as database passwords, API keys, or cloud credentials.
Original NVD description (English source)
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3.