Multiple Fluentd Vulnerabilities: RCE via Tag Placeholder (CVE-2026-44024), Info Disclosure (CVE-2026-44025), Decompression Bomb DoS (CVE-2026-44160), and SSRF (CVE-2026-44161) — Threadlinqs Intelligence
As of 2026-07-01, Multiple Fluentd Vulnerabilities: RCE via Tag Placeholder (CVE-2026-44024), Info Disclosure (CVE-2026-44025), Decompression Bomb DoS (CVE-2026-44160), and SSRF (CVE-2026-44161) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-1041 · Severity: HIGH · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
Fluentd 1.19.3 patches four newly disclosed flaws: a critical (CVSS 9.8) path-traversal-to-RCE bug in the ${tag} placeholder used by output plugins such as out_file, a high-severity (CVSS 7.5) Monitor
Fluentd, the CNCF-graduated log collector widely deployed as the logging backbone of Kubernetes clusters and cloud observability pipelines, shipped version 1.19.3 to remediate four newly assigned CVEs and to re-surface risk from two long-standing unpatched issues.
CVE-2026-44024 (CVSS 9.8, CWE-22/CWE-94) is the most severe: Fluentd's output plugins (e.g. out_file) let administrators construct file paths dynamically using the ${tag} placeholder, but validation of the resulting tag value was insufficient. An untrusted log source (any client able to reach in_http, in_forward, or another accepting input plugin) can send a record whose tag contains path-traversal sequences such as ../../. When that tag is substituted into a path template like /var/log/${tag}.log, Fluentd will write to attacker-chosen paths outside the intended log directory. Because Fluentd can be configured to write files with attacker-controlled content and, depending on formatting options, attacker-controlled extensions, this primitive escalates from arbitrary file write to full remote code execution — e.g. by dropping a cron file, an SSH authorized_keys entry, a web shell into a served directory, or a malicious Fluentd plugin/config file that is subsequently loaded. No authentication is required if the vulnerable input plugin is reachable from an untrusted network.
CVE-2026-44025 (CVSS 7.5, CWE-200/CWE-306) affects the in_monitor_agent plugin, which exposes a REST API (default TCP/24220) for internal metrics such as /api/plugins.json. The API response unintentionally serializes and returns internal Ruby instance variables of every loaded plugin. If any plugin stores secrets in instance variables — database passwords, API keys, cloud credentials used for output destinations — those values are returned in plaintext to any unauthenticated client that can reach the Monitor Agent port, which is commonly bound to 0.0.0.0 in container/Kubernetes deployments.
CVE-2026-44160 (CVSS 7.5, CWE-409) is a denial-of-service in in_http and in_forward. Both plugins correctly cap the size of the compressed (gzip) payload accepted over the wire, but neither enforces a limit on the size of the data after decompression. A small, highly compressed payload (a classic "zip bomb" / decompression-bomb pattern) can expand to gigabytes in memory during processing, exhausting available RAM and triggering an OOM kill of the Fluentd process — halting all log collection on the affected node/pod.
CVE-2026-44161 (CVSS 7.2, CWE-918) is an SSRF in the out_http output plugin. The endpoint configuration parameter supports placeholder expansion (${tag} and record fields) so the destination URL can be built dynamically from log content. When the placeholder value is derived from untrusted, attacker-supplied log data, the attacker can redirect Fluentd's outbound HTTP requests to arbitrary internal hosts — including cloud instance metadata services (e.g. AWS IMDS at 169.254.169.254), internal admin panels, or other services not intended to be internet-reachable — potentially harvesting IAM/cloud credentials or pivoting further into the network.
Two older, still-relevant CVEs compound the risk picture for unpatched fleets. CVE-2022-39379 (CWE-502) is a remote code execution via insecure deserialization: when the non-default environment variable FLUENT_OJ_OPTION_MODE=object is set, Fluentd's Oj-based JSON parsing deserializes arbitrary Ruby objects from attacker-supplied JSON, enabling RCE without authentication (default configuration is not affected). CVE-2021-41186 (CWE-1333) is a ReDoS in the parser_apache2 plugin: crafted Apache-format log lines exploiting catastrophic backtracking in the path/referer/agent capture groups can consume excessive CPU, causing a denial of service for any deployment parsing untrusted or attacker-influenced Apache logs.
Collectively these flaws threaten confidentiality (credential exposure via Monitor Agent, SSRF to metadata endpoints), integrity (arbitrary file write
Weaknesses (CWE)
CWE-22, CWE-94, CWE-200, CWE-306, CWE-409, CWE-918, CWE-502, CWE-1333
Target sectors: technology, cloud services, government administration, finance, health, managed service providers
Target regions: Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-44024, CVE-2026-44025, CVE-2026-44160, CVE-2026-44161, CVE-2022-39379, CVE-2021-41186, T1595, T1588, T1190, T1059, T1505, T1053, T1098, T1068, T1211, T1036