High severity · published Jul 8, 2026
CVE-2026-44161
Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
fluentd · fluent
< 1.19.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44161
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44161
Patch
https://github.com/fluent/fluentd/commit/c6a01ea2e0ea01977f8d615f7c6dbfae4cba88c9
Issue Tracking
https://github.com/fluent/fluentd/pull/5394
Product
https://github.com/fluent/fluentd/releases/tag/v1.19.3
Mitigation
https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6gr
More from fluentd
9.8
CVE-2026-44024
Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder
9.8
CVE-2022-39379
Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)
7.5
CVE-2026-44160
Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`
7.5
CVE-2026-44025
Fluentd: Exposure of Sensitive Information via Monitor Agent API