Critical severity · published Jul 8, 2026
CVE-2026-44024
Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution. This issue is fixed in version 1.19.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
fluentd · fluent
< 1.19.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44024
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44024
Patch
https://github.com/fluent/fluentd/commit/45c87a81f3ac0b72b3f9dcfe8cfb5f9038f81437
Issue Tracking
https://github.com/fluent/fluentd/pull/5391
Product
https://github.com/fluent/fluentd/releases/tag/v1.19.3
Mitigation
https://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3
More from fluentd
9.8
CVE-2022-39379
Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)
7.5
CVE-2026-44160
Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`
7.5
CVE-2026-44025
Fluentd: Exposure of Sensitive Information via Monitor Agent API
7.2
CVE-2026-44161
Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`