Fluentd Security Flaws Enable Remote Code Execution, SSRF, DoS, and Credential Exposure

Fluentd, a widely used open-source data collector for unified logging, has reported several high-impact vulnerabilities that could enable attackers to achieve remote code execution (RCE), server-side request forgery (SSRF), denial-of-service (DoS), and the exposure of sensitive credentials.

These issues, documented in multiple GitHub Security Advisories, affect Fluentd versions up to 1.19.2 and have been resolved in version 1.19.3.

Given Fluentd’s extensive deployment in cloud-native environments, logging pipelines, and Kubernetes ecosystems, these vulnerabilities pose a significant risk, especially when instances are exposed to untrusted networks.

Fluentd Security Flaws

The most critical vulnerability, tracked as CVE-2026-44024, enables RCE by failing to validate the ${tag} placeholder used in dynamic file path construction.

Attackers can inject path-traversal sequences, such as ../, into log tags, allowing arbitrary file writes or overwrites. When combined with permissive configurations, this can lead to full system compromise by modifying sensitive files, injecting malicious plugins, or altering Fluentd configurations.

The vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely if log input endpoints are exposed.

Another high-severity issue, CVE-2026-44025, affects the Monitor Agent plugin (in_monitor_agent), which exposes internal plugin state via a REST API. The API unintentionally leaks sensitive data, including API keys, database credentials, and cloud tokens stored in plugin instance variables.

If the monitoring endpoint (default port 24220) is accessible externally, attackers can retrieve plaintext secrets without authentication, significantly increasing the risk of lateral movement and data breaches.

Fluentd is also vulnerable to denial-of-service attacks via CVE-2026-44160, which allows attackers to exploit gzip decompression handling in the in_http and in_forward plugins.

By sending specially crafted compressed payloads, adversaries can trigger excessive memory allocation during decompression, leading to process crashes or out-of-memory (OOM) termination. This can disrupt log ingestion pipelines and impact observability across affected infrastructure.

Additionally, CVE-2026-44161 highlights an SSRF vulnerability in the out_http plugin, where placeholder expansion allows attackers to manipulate the destinations of outbound requests.

This could enable access to internal services or cloud metadata endpoints, potentially exposing sensitive information or enabling further compromise within internal networks.

A previously disclosed issue, CVE-2022-39379, remains relevant in certain environments. It involves insecure deserialization leading to RCE when the non-default configuration FLUENT_OJ_OPTION_MODE=object is enabled, allowing crafted JSON payloads to execute arbitrary code.

CVE Highlights

• CVE-2026-44024 – Critical RCE via path traversal in ${tag} placeholder enabling arbitrary file write (CVSS 10.0)
• CVE-2026-44025 – Sensitive credential exposure via Monitor Agent API without authentication (CVSS 7.5+)
• CVE-2026-44160 – DoS via gzip decompression bomb causing memory exhaustion (CVSS 7.5+)
• CVE-2026-44161 – SSRF via dynamic endpoint manipulation in out_http plugin (CVSS 6.5+)
• CVE-2022-39379 – RCE via insecure deserialization in non-default configurations

Security experts strongly recommend upgrading to Fluentd version 1.19.3 immediately. Organizations should also restrict network exposure of Fluentd ports, avoid using untrusted input in placeholders, enforce strict input validation, and ensure services run with the least privilege required to minimize the impact of exploitation.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN