Multiple Fluentd Vulnerabilities: RCE via Tag Placeholder (CVE-2026-44024), Info Disclosure (CVE-2026-44025), Decompression Bomb DoS (CVE-2026-44160), and SSRF (CVE-2026-44161)

Multiple Fluentd Vulnerabilities (TL-2026-1041), also tracked as Fluentd Tag Placeholder RCE, is a high-severity software vulnerability scored CVSS 9.8, first published 2026-07-01. It has no confirmed attribution, affects Fluentd Project (CNCF) fluentd (RubyGem), references 6 CVEs (CVE-2026-44024, CVE-2026-44025, CVE-2026-44160), maps to 19 MITRE ATT&CK techniques (T1005, T1036, T1046), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-1041

Threat ID
TL-2026-1041
Also known as
Fluentd Tag Placeholder RCE, Fluentd Monitor Agent Info Disclosure, Fluentd Decompression Bomb DoS, Fluentd out_http SSRF
Severity
HIGH
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-01
Last reviewed
2026-07-01
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, cloud services, government administration, finance, health, managed service providers
Target regions
Global
Detection rules
9
Indicators of compromise
18

Fluentd 1.19.3 patches four newly disclosed flaws: a critical (CVSS 9.8) path-traversal-to-RCE bug in the ${tag} placeholder used by output plugins such as out_file, a high-severity (CVSS 7.5) Monitor Agent API information disclosure exposing plugin instance variables (credentials, API keys), a high-severity (CVSS 7.5) gzip decompression-bomb DoS in in_http/in_forward, and a high-severity (CVSS 7.2) SSRF in out_http via unsafe placeholder expansion in the endpoint parameter that can reach cloud metadata services. Two older unpatched issues, CVE-2022-39379 (insecure Oj deserialization RCE in non-default config) and CVE-2021-41186 (ReDoS in parser_apache2), remain relevant to unpatched fleets.

How Multiple Fluentd Vulnerabilities works

Fluentd, the CNCF-graduated log collector widely deployed as the logging backbone of Kubernetes clusters and cloud observability pipelines, shipped version 1.19.3 to remediate four newly assigned CVEs and to re-surface risk from two long-standing unpatched issues.

CVE-2026-44024 (CVSS 9.8, CWE-22/CWE-94) is the most severe: Fluentd's output plugins (e.g. out_file) let administrators construct file paths dynamically using the ${tag} placeholder, but validation of the resulting tag value was insufficient. An untrusted log source (any client able to reach in_http, in_forward, or another accepting input plugin) can send a record whose tag contains path-traversal sequences such as ../../. When that tag is substituted into a path template like /var/log/${tag}.log, Fluentd will write to attacker-chosen paths outside the intended log directory. Because Fluentd can be configured to write files with attacker-controlled content and, depending on formatting options, attacker-controlled extensions, this primitive escalates from arbitrary file write to full remote code execution — e.g. by dropping a cron file, an SSH authorized_keys entry, a web shell into a served directory, or a malicious Fluentd plugin/config file that is subsequently loaded. No authentication is required if the vulnerable input plugin is reachable from an untrusted network.

CVE-2026-44025 (CVSS 7.5, CWE-200/CWE-306) affects the in_monitor_agent plugin, which exposes a REST API (default TCP/24220) for internal metrics such as /api/plugins.json. The API response unintentionally serializes and returns internal Ruby instance variables of every loaded plugin. If any plugin stores secrets in instance variables — database passwords, API keys, cloud credentials used for output destinations — those values are returned in plaintext to any unauthenticated client that can reach the Monitor Agent port, which is commonly bound to 0.0.0.0 in container/Kubernetes deployments.

CVE-2026-44160 (CVSS 7.5, CWE-409) is a denial-of-service in in_http and in_forward. Both plugins correctly cap the size of the compressed (gzip) payload accepted over the wire, but neither enforces a limit on the size of the data after decompression. A small, highly compressed payload (a classic "zip bomb" / decompression-bomb pattern) can expand to gigabytes in memory during processing, exhausting available RAM and triggering an OOM kill of the Fluentd process — halting all log collection on the affected node/pod.

CVE-2026-44161 (CVSS 7.2, CWE-918) is an SSRF in the out_http output plugin. The endpoint configuration parameter supports placeholder expansion (${tag} and record fields) so the destination URL can be built dynamically from log content. When the placeholder value is derived from untrusted, attacker-supplied log data, the attacker can redirect Fluentd's outbound HTTP requests to arbitrary internal hosts — including cloud instance metadata services (e.g. AWS IMDS at 169.254.169.254), internal admin panels, or other services not intended to be internet-reachable — potentially harvesting IAM/cloud credentials or pivoting further into the network.

Two older, still-relevant CVEs compound the risk picture for unpatched fleets. CVE-2022-39379 (CWE-502) is a remote code execution via insecure deserialization: when the non-default environment variable FLUENT_OJ_OPTION_MODE=object is set, Fluentd's Oj-based JSON parsing deserializes arbitrary Ruby objects from attacker-supplied JSON, enabling RCE without authentication (default configuration is not affected). CVE-2021-41186 (CWE-1333) is a ReDoS in the parser_apache2 plugin: crafted Apache-format log lines exploiting catastrophic backtracking in the path/referer/agent capture groups can consume excessive CPU, causing a denial of service for any deployment parsing untrusted or attacker-influenced Apache logs.

Collectively these flaws threaten confidentiality (credential exposure via Monitor Agent, SSRF to metadata endpoints), integrity (arbitrary file write/RCE), and availability (decompression bomb, ReDoS) of any Fluentd-based logging pipeline — a category of infrastructure that is frequently exposed to semi-trusted or multi-tenant log producers (Kubernetes DaemonSets ingesting pod logs, shared SaaS logging endpoints, CI/CD log forwarders) making several of these bugs practically reachable without insider access.

MITRE ATT&CK techniques used in TL-2026-1041

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading; T1211 Exploitation for Stealth

Discovery

T1046 Network Service Discovery; T1083 File and Directory Discovery

Persistence

T1053 Scheduled Task/Job; T1098 Account Manipulation; T1505 Server Software Component

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Impact

T1489 Service Stop; T1499 Endpoint Denial of Service

Credential Access

T1552 Unsecured Credentials

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1588 Obtain Capabilities

Reconnaissance

T1595 Active Scanning

Affected products and versions in Multiple Fluentd Vulnerabilities

  • Fluentd Project (CNCF) — fluentd (RubyGem)
    Vulnerable versions: < 1.19.3 (CVE-2026-44024, CVE-2026-44025, CVE-2026-44160, CVE-2026-44161); 1.13.2 - 1.15.2 with FLUENT_OJ_OPTION_MODE=object (CVE-2022-39379); 0.14.14 - 1.14.1 (CVE-2021-41186)
    Fixed in: 1.19.3; 1.15.3; 1.14.2

Remediation for Multiple Fluentd Vulnerabilities

Patches

  • Fluentd 1.19.3 (fixes CVE-2026-44024, CVE-2026-44025, CVE-2026-44160, CVE-2026-44161)
  • Fluentd 1.15.3 (fixes CVE-2022-39379)
  • Fluentd 1.14.2 (fixes CVE-2021-41186)

Immediate actions

  • Upgrade Fluentd (fluentd gem) to version 1.19.3 or later, which fixes all four new CVEs (CVE-2026-44024, CVE-2026-44025, CVE-2026-44160, CVE-2026-44161)
  • Restrict network access to Fluentd input ports (24224 in_forward, 9880 in_http, 24220 Monitor Agent) to trusted networks only via firewall/NetworkPolicy
  • Bind the Monitor Agent API to localhost/127.0.0.1 rather than 0.0.0.0
  • Avoid using ${tag} or record-field placeholders sourced from untrusted input in file path parameters (out_file path) or HTTP endpoint parameters (out_http endpoint)
  • Block outbound access from Fluentd hosts to cloud instance metadata IPs (169.254.169.254, fd00:ec2::254) via firewall/IMDSv2 enforcement where feasible

Workarounds

  • If unable to upgrade: never use ${tag} or record placeholders as hostnames/paths from untrusted log sources
  • Do not set FLUENT_OJ_OPTION_MODE=object (removes CVE-2022-39379 exposure)
  • Avoid parser_apache2 for logs that cannot be guaranteed to originate from trusted Apache instances, or deploy the patched parser_apache2.rb via FLUENT_PLUGIN/--plugin override
  • Front in_http with a reverse proxy (e.g. Nginx) that enforces strict compressed and decompressed body size limits before traffic reaches Fluentd

Longer-term hardening

  • Run Fluentd under a non-root, least-privilege service account with a restricted filesystem (chroot/container read-only root FS) to limit blast radius of arbitrary file write
  • Implement strict allow-list validation/sanitization for any placeholder value derived from log content before it is used in a path or URL
  • Deploy egress filtering / allow-listed destination hosts for out_http and similar forwarding plugins
  • Monitor Fluentd process memory and add cgroup/container memory limits with alerting to catch decompression-bomb DoS attempts early
  • Audit third-party plugins for use of sensitive instance variables that could be exposed via the Monitor Agent API

CVEs associated with Multiple Fluentd Vulnerabilities

CVE-2026-44024, CVE-2026-44025, CVE-2026-44160, CVE-2026-44161, CVE-2022-39379, CVE-2021-41186

Weaknesses (CWE) in Multiple Fluentd Vulnerabilities

CWE-22, CWE-94, CWE-200, CWE-306, CWE-409, CWE-918, CWE-502, CWE-1333

Timeline of Multiple Fluentd Vulnerabilities

  • CVE-2021-41186 (ReDoS in parser_apache2, GHSA-hwhf-64mh-r662) publicly disclosed; patched in Fluentd 1.14.2
  • CVE-2022-39379 (insecure Oj deserialization RCE in non-default FLUENT_OJ_OPTION_MODE=object config, GHSA-fppq-mj76-fpj2) publicly disclosed; patched in Fluentd 1.15.3
  • Fluentd 1.19.3 released, remediating all four newly disclosed CVEs (CVE-2026-44024, CVE-2026-44025, CVE-2026-44160, CVE-2026-44161)
  • CVE-2026-44161 (SSRF via out_http placeholder expansion, GHSA-72f5-rr8c-r6gr) publicly disclosed
  • CVE-2026-44160 (gzip decompression bomb DoS in in_http/in_forward, GHSA-j9cw-hwqf-85w7) publicly disclosed
  • CVE-2026-44025 (Monitor Agent API information disclosure, GHSA-pr7j-96cj-549h) publicly disclosed
  • CVE-2026-44024 (critical RCE via ${tag} placeholder path traversal, GHSA-44hj-4m45-frj3) publicly disclosed
  • Cyberpress publishes analysis summarizing the four patched Fluentd flaws and remediation guidance
  • Cyber Security News publishes roundup covering all four new CVEs plus continued relevance of CVE-2022-39379 and CVE-2021-41186

Sources cited for Multiple Fluentd Vulnerabilities

Threats related to Multiple Fluentd Vulnerabilities

Detection coverage for TL-2026-1041

As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1041 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats