High severity7.2NVD Advisory· Published Jul 8, 2026· Updated Jul 13, 2026
CVE-2026-44161
CVE-2026-44161
Description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
fluentdRubyGems | < 1.19.3 | 1.19.3 |
Affected products
17- osv-coords15 versionspkg:apk/chainguard/kube-fluentd-operatorpkg:apk/chainguard/ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesispkg:apk/chainguard/ruby3.2-kube-logging-operator-fluentd-outputspkg:apk/chainguard/ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesispkg:apk/chainguard/ruby3.4-fluentd-kubernetes-daemonset-1.19-kinesispkg:apk/chainguard/ruby3.4-kube-logging-operator-fluentd-outputspkg:apk/chainguard/ruby4.0-fluentd-kubernetes-daemonset-1.19-kinesispkg:apk/wolfi/kube-fluentd-operatorpkg:apk/wolfi/ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesispkg:apk/wolfi/ruby3.2-kube-logging-operator-fluentd-outputspkg:apk/wolfi/ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesispkg:apk/wolfi/ruby3.4-fluentd-kubernetes-daemonset-1.19-kinesispkg:apk/wolfi/ruby3.4-kube-logging-operator-fluentd-outputspkg:apk/wolfi/ruby4.0-fluentd-kubernetes-daemonset-1.19-kinesispkg:bitnami/fluentd
< 1.18.2-r72+ 14 more
- (no CPE)range: < 1.18.2-r72
- (no CPE)range: < 1.19.2.1.1-r5
- (no CPE)range: < 6.7.0-r7
- (no CPE)range: < 1.19.3.1.0-r0
- (no CPE)range: < 1.19.3.1.0-r0
- (no CPE)range: < 6.7.0-r7
- (no CPE)range: < 1.19.3.1.0-r0
- (no CPE)range: < 1.18.2-r72
- (no CPE)range: < 1.19.2.1.1-r5
- (no CPE)range: < 6.7.0-r7
- (no CPE)range: < 1.19.3.1.0-r0
- (no CPE)range: < 1.19.3.1.0-r0
- (no CPE)range: < 6.7.0-r7
- (no CPE)range: < 1.19.3.1.0-r0
- (no CPE)range: < 1.19.3
Patches
Vulnerability mechanics
References
5- github.com/fluent/fluentd/commit/c6a01ea2e0ea01977f8d615f7c6dbfae4cba88c9nvdPatch
- github.com/fluent/fluentd/pull/5394nvdIssue TrackingPatch
- github.com/advisories/GHSA-72f5-rr8c-r6grghsaADVISORY
- github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6grnvdMitigationVendor AdvisoryWEB
- github.com/fluent/fluentd/releases/tag/v1.19.3nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.