GHSA-PR7J-96CJ-549H Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API

Fluentd's Monitor Agent plugin inmonitoragent exposes internal metrics and plugin information via a REST API. It was discovered that the API response /api/plugins.json and related endpoints unintentionally includes internal instance variables of loaded plugins. If any plugins store sensitive...

Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API

Fluentd's Monitor Agent plugin inmonitoragent exposes internal metrics and plugin information via a REST API. It was discovered that the API response /api/plugins.json and related endpoints unintentionally includes internal instance variables of loaded plugins. If any plugins store sensitive...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the inmonitoragent process. An attacker can access sensitive internal instance variables, including credentials, by sending HTTP requests to the Monitor Agent API endpoints. The impact...

Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

Fluentd allows dynamically constructing file paths using the $tag placeholder. It was discovered that validation for this placeholder was insufficient. If a Fluentd instance is configured to receive logs from untrusted sources and uses the $tag placeholder in file configurations such as the path...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the path parameter in output plugins when using the $tag placeholder. An attacker can overwrite arbitrary files or inject malicious content by sending specially crafted log entries containing path traversal...

GHSA-44HJ-4M45-FRJ3 Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

Fluentd allows dynamically constructing file paths using the $tag placeholder. It was discovered that validation for this placeholder was insufficient. If a Fluentd instance is configured to receive logs from untrusted sources and uses the $tag placeholder in file configurations such as the path...

PT-2026-53005

Name of the Vulnerable Software and Affected Versions Fluentd versions prior to 1.19.3 Description The out http output plugin allows the use of placeholders, such as $tag, in the endpoint configuration parameter. If a placeholder value is derived from untrusted input, an attacker can control the...

Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

Fluentd allows dynamically constructing file paths using the $tag placeholder. It was discovered that validation for this placeholder was insufficient. If a Fluentd instance is configured to receive logs from untrusted sources and uses the $tag placeholder in file configurations such as the path...

PT-2026-53003

Name of the Vulnerable Software and Affected Versions Fluentd versions prior to 1.19.3 Description The Monitor Agent plugin in monitor agent exposes internal metrics and plugin information through a REST API. The responses from the /api/plugins.json endpoint and related endpoints unintentionally...

PT-2026-53002

Name of the Vulnerable Software and Affected Versions Fluentd versions prior to 1.19.3 Description Insufficient validation of the $tag placeholder allows for the dynamic construction of file paths that can be manipulated. If an instance is configured to receive logs from untrusted sources and use...

Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API

Fluentd's Monitor Agent plugin inmonitoragent exposes internal metrics and plugin information via a REST API. It was discovered that the API response /api/plugins.json and related endpoints unintentionally includes internal instance variables of loaded plugins. If any plugins store sensitive...

PT-2026-53004

Name of the Vulnerable Software and Affected Versions Fluentd versions prior to 1.19.3 Description The in http and in forward plugins support gzip-compressed data but only enforce size limits on the compressed payloads via settings like body size limit and chunk size limit. Because no limit is...

Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`

The outhttp output plugin allows the use of placeholders such as $tag in the endpoint configuration parameter. It was discovered that if the placeholder value is derived from untrusted user input, an attacker can maliciously control the destination hostname of the outbound HTTP requests made by...

Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

Fluentd's inhttp and inforward plugins support receiving gzip-compressed data. While Fluentd correctly enforces size limits on the incoming compressed payloads e.g., via bodysizelimit or chunksizelimit, it was discovered that there is no limit enforced on the size of the decompressed data. If a...

CVE-2026-54904 vulnerabilities

Vulnerabilities for packages: ruby3.3-fluentd-kubernetes-daemonset, kube-logging-operator, ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-rails, ruby3.4-fluentd-kubernetes-daemonset, ruby3.2-rails, ruby4.0-rails, ruby3.4-rails, kube-fluentd-operator...

GHSA-H8W8-99G7-QMVJ vulnerabilities

Vulnerabilities for packages: ruby3.3-fluentd-kubernetes-daemonset, kube-logging-operator, ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-rails, ruby3.4-fluentd-kubernetes-daemonset, ruby3.2-rails, ruby4.0-rails, ruby3.4-rails, kube-fluentd-operator...

GHSA-WV3X-4VXV-WHPP vulnerabilities

Vulnerabilities for packages: ruby3.3-fluentd-kubernetes-daemonset, kube-logging-operator, ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-rails, ruby3.4-fluentd-kubernetes-daemonset, ruby3.2-rails, ruby4.0-rails, ruby3.4-rails, kube-fluentd-operator...

GHSA-6WX8-W4F5-WWCR vulnerabilities

Vulnerabilities for packages: ruby3.3-fluentd-kubernetes-daemonset, kube-logging-operator, ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-rails, ruby3.4-fluentd-kubernetes-daemonset, ruby3.2-rails, ruby4.0-rails, ruby3.4-rails, kube-fluentd-operator...

CVE-2026-54906 vulnerabilities

Vulnerabilities for packages: ruby3.3-fluentd-kubernetes-daemonset, kube-logging-operator, ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-rails, ruby3.4-fluentd-kubernetes-daemonset, ruby3.2-rails, ruby4.0-rails, ruby3.4-rails, kube-fluentd-operator...

CVE-2026-54905 vulnerabilities

Vulnerabilities for packages: ruby3.3-fluentd-kubernetes-daemonset, kube-logging-operator, ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-rails, ruby3.4-fluentd-kubernetes-daemonset, ruby3.2-rails, ruby4.0-rails, ruby3.4-rails, kube-fluentd-operator...