By vendor

Fluentd vulnerabilities

Known CVEs affecting Fluentd products, prioritized by severity, with SEC.co remediation and detection guidance.

3 published vulnerabilities

• CVE-2026-44025HIGH 7.5

  Fluentd's Monitor Agent plugin exposes sensitive internal data through publicly accessible REST API endpoints. Before version 1.19.3, responses from endpoints like /api/plugins.json leak internal system variables that may contain database passwords, API keys, and cloud credentials. An attacker with network access to the monitoring API can retrieve these secrets without authentication, potentially compromising connected databases and cloud services.

• CVE-2026-44160HIGH 7.5

  Fluentd versions before 1.19.3 contain a denial-of-service vulnerability in the in_http and in_forward plugins. The plugins accept gzip-compressed data but only limit the size of the *compressed* payload, not the decompressed output. An attacker can send a specially crafted compressed message that expands to an enormous size when decompressed, exhausting the server's memory and causing Fluentd to become unavailable. This affects any Fluentd deployment that receives data from untrusted networks or users.

• CVE-2026-44161HIGH 7.2

  Fluentd is a widely-used log collection and forwarding tool. Its HTTP output plugin allows operators to use dynamic placeholders (like ${tag}) in the destination URL. Prior to version 1.19.3, if an attacker can influence the values used in those placeholders—for example, by injecting a crafted tag into logs—they can redirect Fluentd's outbound HTTP requests to arbitrary internal services on the organization's network. This allows an attacker to probe or interact with services that should not be exposed, potentially leading to information disclosure or denial of service.