CVE-2026-44161

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/fluent/fluentd/commit/c6a01ea2e0ea01977f8d615f7c6dbfae4cba88c9	Patch
https://github.com/fluent/fluentd/pull/5394	Issue Tracking Patch
https://github.com/fluent/fluentd/releases/tag/v1.19.3	Product Release Notes
https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6gr	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Fluentd recopila eventos de varias fuentes de datos y los escribe en archivos, RDBMS, NoSQL, IaaS, SaaS, Hadoop, etc. Antes de la versión 1.19.3, el plugin de salida out_http de Fluentd permite marcadores de posición como ${tag} en el parámetro de configuración del endpoint, y si un valor de marcador de posición se deriva de una entrada no confiable, un atacante puede controlar el nombre de host de destino de las solicitudes HTTP salientes y forzar solicitudes a servicios internos arbitrarios. Este problema está corregido en la versión 1.19.3.

Information

Published : 2026-07-08 22:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-44161

Mitre link : CVE-2026-44161

CVE.ORG link : CVE-2026-44161

JSON object : View

Products Affected

fluentd

fluentd

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-44161", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44161", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T14:37:57.811738Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "fluent", "product": "fluentd", "versions": [{"status": "affected", "version": "< 1.19.3"}]}]}], "published": "2026-07-08T22:17:14.737", "references": [{"url": "https://github.com/fluent/fluentd/commit/c6a01ea2e0ea01977f8d615f7c6dbfae4cba88c9", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fluent/fluentd/pull/5394", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fluent/fluentd/releases/tag/v1.19.3", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6gr", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3."}, {"lang": "es", "value": "Fluentd recopila eventos de varias fuentes de datos y los escribe en archivos, RDBMS, NoSQL, IaaS, SaaS, Hadoop, etc. Antes de la versi\u00f3n 1.19.3, el plugin de salida out_http de Fluentd permite marcadores de posici\u00f3n como ${tag} en el par\u00e1metro de configuraci\u00f3n del endpoint, y si un valor de marcador de posici\u00f3n se deriva de una entrada no confiable, un atacante puede controlar el nombre de host de destino de las solicitudes HTTP salientes y forzar solicitudes a servicios internos arbitrarios. Este problema est\u00e1 corregido en la versi\u00f3n 1.19.3."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AB3C52C-7D3D-4BA5-A8D0-8AC7DA6030EC", "versionEndExcluding": "1.19.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}