CVE-2026-44161: Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`
fluent · fluentd
No fix listed · Affected: fluentd · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
Higher than 38% of scored CVEs
DescriptionNVD
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Weakness
- Server-Side Request Forgery
- Vendor
- fluent
- Published
- July 2026
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 1 Jul.
- Fluentd fixes critical RCE bug CVE-2026-44024 in log collectorSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.