Vulnerability Description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fluentd | Fluentd | < 1.19.3 |
Related Weaknesses (CWE)
References
- https://github.com/fluent/fluentd/commit/c6a01ea2e0ea01977f8d615f7c6dbfae4cba88cPatch
- https://github.com/fluent/fluentd/pull/5394Issue TrackingPatch
- https://github.com/fluent/fluentd/releases/tag/v1.19.3ProductRelease Notes
- https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6grMitigationVendor Advisory
FAQ
What is CVE-2026-44161?
CVE-2026-44161 is a vulnerability with a CVSS score of 7.2 (HIGH). Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ...
How severe is CVE-2026-44161?
CVE-2026-44161 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-44161?
Check the references section above for vendor advisories and patch information. Affected products include: Fluentd Fluentd.