cve-2026-44161

HIGH CVSS 7.2 cvelistv5

Description

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3.

Timeline

Published: 2026-07-08 21:25 UTC
Last Modified: 2026-07-09

CVSS Details

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE

Affected Products

fluent fluentd

Weaknesses (CWE)

CWE-918

SSVC (CISA Stakeholder-Specific Vulnerability Categorization) CISA Coordinator v2.0.3

Exploitation: none
Automatable: yes
Technical Impact: partial
Decision timestamp: 2026-07-09T14:37:57.811738Z

What is SSVC? — CISA's vulnerability-prioritisation framework using a decision tree rather than a single score.

References

https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6gr x_refsource_CONFIRM
https://github.com/fluent/fluentd/pull/5394 x_refsource_MISC
https://github.com/fluent/fluentd/commit/c6a01ea2e0ea01977f8d615f7c6dbfae4cba88c9 x_refsource_MISC
https://github.com/fluent/fluentd/releases/tag/v1.19.3 x_refsource_MISC

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44161",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T14:37:57.811738Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T14:40:31.700Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fluentd",
          "vendor": "fluent",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.19.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T21:25:43.892Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6gr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6gr"
        },
        {
          "name": "https://github.com/fluent/fluentd/pull/5394",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fluent/fluentd/pull/5394"
        },
        {
          "name": "https://github.com/fluent/fluentd/commit/c6a01ea2e0ea01977f8d615f7c6dbfae4cba88c9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fluent/fluentd/commit/c6a01ea2e0ea01977f8d615f7c6dbfae4cba88c9"
        },
        {
          "name": "https://github.com/fluent/fluentd/releases/tag/v1.19.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fluent/fluentd/releases/tag/v1.19.3"
        }
      ],
      "source": {
        "advisory": "GHSA-72f5-rr8c-r6gr",
        "discovery": "UNKNOWN"
      },
      "title": "Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44161",
    "datePublished": "2026-07-08T21:25:43.892Z",
    "dateReserved": "2026-05-05T14:39:34.922Z",
    "dateUpdated": "2026-07-09T14:40:31.700Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

cve-2026-44161

Raw JSON Data