CVE-2026-44025

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agent plugin in_monitor_agent exposes internal metrics and plugin information via a REST API, and responses from /api/plugins.json and related endpoints unintentionally include internal instance variables that may contain database passwords, API keys, or cloud credentials. This issue is fixed in version 1.19.3.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/fluent/fluentd/commit/990921518971699b9a97441970674d1800e29177	Patch
https://github.com/fluent/fluentd/pull/5392	Issue Tracking Patch
https://github.com/fluent/fluentd/releases/tag/v1.19.3	Release Notes
https://github.com/fluent/fluentd/security/advisories/GHSA-pr7j-96cj-549h	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Fluentd recopila eventos de varias fuentes de datos y los escribe en archivos, RDBMS, NoSQL, IaaS, SaaS, Hadoop y otros. Antes de la versión 1.19.3, el plugin Monitor Agent de Fluentd, in_monitor_agent, expone métricas internas e información del plugin a través de una API REST, y las respuestas de /api/plugins.json y los endpoints relacionados incluyen involuntariamente variables de instancia internas que pueden contener contraseñas de bases de datos, claves de API o credenciales de la nube. Este problema está solucionado en la versión 1.19.3.

Information

Published : 2026-07-08 22:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-44025

Mitre link : CVE-2026-44025

CVE.ORG link : CVE-2026-44025

JSON object : View

Products Affected

fluentd

fluentd

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-44025", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44025", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T13:47:05.851155Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "fluent", "product": "fluentd", "versions": [{"status": "affected", "version": "< 1.19.3"}]}]}], "published": "2026-07-08T22:17:14.473", "references": [{"url": "https://github.com/fluent/fluentd/commit/990921518971699b9a97441970674d1800e29177", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fluent/fluentd/pull/5392", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fluent/fluentd/releases/tag/v1.19.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fluent/fluentd/security/advisories/GHSA-pr7j-96cj-549h", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agent plugin in_monitor_agent exposes internal metrics and plugin information via a REST API, and responses from /api/plugins.json and related endpoints unintentionally include internal instance variables that may contain database passwords, API keys, or cloud credentials. This issue is fixed in version 1.19.3."}, {"lang": "es", "value": "Fluentd recopila eventos de varias fuentes de datos y los escribe en archivos, RDBMS, NoSQL, IaaS, SaaS, Hadoop y otros. Antes de la versi\u00f3n 1.19.3, el plugin Monitor Agent de Fluentd, in_monitor_agent, expone m\u00e9tricas internas e informaci\u00f3n del plugin a trav\u00e9s de una API REST, y las respuestas de /api/plugins.json y los endpoints relacionados incluyen involuntariamente variables de instancia internas que pueden contener contrase\u00f1as de bases de datos, claves de API o credenciales de la nube. Este problema est\u00e1 solucionado en la versi\u00f3n 1.19.3."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AB3C52C-7D3D-4BA5-A8D0-8AC7DA6030EC", "versionEndExcluding": "1.19.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}