Remote Code Execution in Fluentd out_http Plugin

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitHub, Inc.

Description

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-44161

Affected Vendors & Products

Vendor	Product	Version / Range
treasure_data	fluentd	1.19.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Fluentd out_http output plugin prior to version 1.19.3. The plugin allows the use of placeholders such as ${tag} in the endpoint configuration parameter. If the placeholder value is derived from untrusted input, an attacker can manipulate it to control the destination hostname of outbound HTTP requests. This means the attacker can force Fluentd to send requests to arbitrary internal services.

Impact Analysis

The vulnerability can allow an attacker to redirect outbound HTTP requests from Fluentd to arbitrary internal services. This can lead to unauthorized access or interaction with internal systems that are not intended to be exposed, potentially causing information disclosure or disruption of services.

Mitigation Strategies

To mitigate this vulnerability, upgrade Fluentd to version 1.19.3 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-44161. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70