High severity · published Jul 8, 2026
CVE-2026-44025
Fluentd: Exposure of Sensitive Information via Monitor Agent API
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agent plugin in_monitor_agent exposes internal metrics and plugin information via a REST API, and responses from /api/plugins.json and related endpoints unintentionally include internal instance variables that may contain database passwords, API keys, or cloud credentials. This issue is fixed in version 1.19.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
fluentd · fluent
< 1.19.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44025
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44025
Patch
https://github.com/fluent/fluentd/commit/990921518971699b9a97441970674d1800e29177
Issue Tracking
https://github.com/fluent/fluentd/pull/5392
Release Notes
https://github.com/fluent/fluentd/releases/tag/v1.19.3
Patch
https://github.com/fluent/fluentd/security/advisories/GHSA-pr7j-96cj-549h
More from fluentd
9.8
CVE-2026-44024
Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder
9.8
CVE-2022-39379
Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)
7.5
CVE-2026-44160
Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`
7.2
CVE-2026-44161
Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`