PT-2026-53003

Name of the Vulnerable Software and Affected Versions Fluentd versions prior to 1.19.3 Description The Monitor Agent plugin in monitor agent exposes internal metrics and plugin information through a REST API. The responses from the /api/plugins.json endpoint and related endpoints unintentionally...

Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API

Fluentd's Monitor Agent plugin inmonitoragent exposes internal metrics and plugin information via a REST API. It was discovered that the API response /api/plugins.json and related endpoints unintentionally includes internal instance variables of loaded plugins. If any plugins store sensitive...

PT-2026-53007

The fluent-plugin-opentelemetry plugin specifically the in opentelemetry HTTP input lacked strict size limits on incoming requests. It was discovered that the plugin read the entire request body and decompressed payloads into memory without enforcing maximum size thresholds. If the OpenTelemetry...

PT-2026-53004

Name of the Vulnerable Software and Affected Versions Fluentd versions prior to 1.19.3 Description The in http and in forward plugins support gzip-compressed data but only enforce size limits on the compressed payloads via settings like body size limit and chunk size limit. Because no limit is...

Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

Fluentd's inhttp and inforward plugins support receiving gzip-compressed data. While Fluentd correctly enforces size limits on the incoming compressed payloads e.g., via bodysizelimit or chunksizelimit, it was discovered that there is no limit enforced on the size of the decompressed data. If a...

Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`

The outhttp output plugin allows the use of placeholders such as $tag in the endpoint configuration parameter. It was discovered that if the placeholder value is derived from untrusted user input, an attacker can maliciously control the destination hostname of the outbound HTTP requests made by...

fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3`

"The fluent-plugin-s3 plugin specifically the ins3 input plugin supports reading and decompressing heavily compressed files such as gzip, lzma2, and lzop from Amazon S3. It was discovered that the plugin read the entire decompressed payload into memory at once without enforcing a strict size limi...

fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`

The fluent-plugin-opentelemetry plugin specifically the inopentelemetry HTTP input lacked strict size limits on incoming requests. It was discovered that the plugin read the entire request body and decompressed payloads into memory without enforcing maximum size thresholds. If the OpenTelemetry...

CVE-2026-54904 vulnerabilities

Vulnerabilities for packages: ruby4.0-fluentd-kubernetes-daemonset, ruby3.4-rails, cinc-auditor, logstash-fips, ruby3.3-rails, kube-logging-operator, kube-fluentd-operator, logstash, ruby3.2-rails, ruby4.0-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset,...

GHSA-6WX8-W4F5-WWCR vulnerabilities

Vulnerabilities for packages: ruby4.0-fluentd-kubernetes-daemonset, ruby3.4-rails, cinc-auditor, logstash-fips, ruby3.3-rails, kube-logging-operator, kube-fluentd-operator, logstash, ruby3.2-rails, ruby4.0-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset,...

GHSA-H8W8-99G7-QMVJ vulnerabilities

Vulnerabilities for packages: ruby4.0-fluentd-kubernetes-daemonset, ruby3.4-rails, cinc-auditor, logstash-fips, ruby3.3-rails, kube-logging-operator, kube-fluentd-operator, logstash, ruby3.2-rails, ruby4.0-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset,...

GHSA-WV3X-4VXV-WHPP vulnerabilities

Vulnerabilities for packages: ruby4.0-fluentd-kubernetes-daemonset, ruby3.4-rails, cinc-auditor, logstash-fips, ruby3.3-rails, kube-logging-operator, kube-fluentd-operator, logstash, ruby3.2-rails, ruby4.0-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset,...

CVE-2026-54906 vulnerabilities

Vulnerabilities for packages: ruby4.0-fluentd-kubernetes-daemonset, ruby3.4-rails, cinc-auditor, logstash-fips, ruby3.3-rails, kube-logging-operator, kube-fluentd-operator, logstash, ruby3.2-rails, ruby4.0-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset,...

CVE-2026-54905 vulnerabilities

Vulnerabilities for packages: ruby4.0-fluentd-kubernetes-daemonset, ruby3.4-rails, cinc-auditor, logstash-fips, ruby3.3-rails, kube-logging-operator, kube-fluentd-operator, logstash, ruby3.2-rails, ruby4.0-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset,...

CVE-2026-54297 vulnerabilities

Vulnerabilities for packages: cinc-auditor, gitlab-rails-ce-fips, logstash-fips, kube-fluentd-operator, kube-logging-operator, gitlab-rails-ce, logstash, gitlab-cng, ruby3.3-faraday...

GHSA-98M9-HRRM-R99R vulnerabilities

Vulnerabilities for packages: cinc-auditor, gitlab-rails-ce-fips, logstash-fips, kube-fluentd-operator, kube-logging-operator, gitlab-rails-ce, logstash, gitlab-cng, ruby3.3-faraday...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: k3s, kyverno, ingress-nginx-controller, snyk-cli, aws-flb-firehose, aws-flb-cloudwatch, coredns, dask-gateway, kubescape, runc, chezmoi, cloud-provider-aws, fscrypt, kubernetes-dashboard, redka, external-secrets-operator, kaf, helm, external-dns, spire-server,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: tigera-operator, kubeflow-katib, weaviate, flux-helm-controller, kserve-modelmesh-serving, cloud-provider-azure, kine, rancher-loglevel, spicedb-operator, terraform-provider-sendgrid, yunikorn-k8shim, timescaledb-parallel-copy, aws-s3-controller, kuberlr,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: kubernetes-event-exporter, kubernetes-csi-driver-nfs, falcoctl, sftpgo, cloudnative-pg, kubeflow-katib, rancher-machine, opentelemetry-operator, weaviate, cloud-provider-aws, kube-arangodb, kubernetes-csi-livenessprobe, flux-helm-controller, terraform-provider-azurea...

CLEANSTART-2026-HZ73294 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

Multiple security vulnerabilities affect the kube-fluentd-operator package. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. See references for individual...