CVE-2026-44025

Published: Jul 8, 2026Modified: Jul 16, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agent plugin in_monitor_agent exposes internal metrics and plugin information via a REST API, and responses from /api/plugins.json and related endpoints unintentionally include internal instance variables that may contain database passwords, API keys, or cloud credentials. This issue is fixed in version 1.19.3.

Affected (1)

Products: Fluentd: Fluentd

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fluentd Fluentd	Before 1.19.3

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (4)

https://github.com/fluent/fluentd/commit/990921518971699b9a97441970674d1800e29177

Source: security-advisories@github.com

Patch

https://github.com/fluent/fluentd/pull/5392

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/fluent/fluentd/releases/tag/v1.19.3

Source: security-advisories@github.com

Release Notes

https://github.com/fluent/fluentd/security/advisories/GHSA-pr7j-96cj-549h

Source: security-advisories@github.com

PatchVendor Advisory

Timeline

No history available yet.