CVE-2026-44024

Name of the Vulnerable Software and Affected Versions Fluentd versions prior to 1.19.3

Description Fluentd allows the dynamic construction of file paths using the ${tag} placeholder. Insufficient validation of this placeholder in file configurations, specifically within the path parameter of the out file plugin, enables attackers to send untrusted tags containing path traversal characters. This allows for the writing or overwriting of arbitrary files on the system, bypassing directory restrictions, which can be escalated to remote code execution by modifying critical system files, injecting executable plugins, or altering configuration files.

Recommendations Update to version 1.19.3. Avoid using the ${tag} placeholder in the path parameter of output plugins if the tag originates from an untrusted source. Restrict network access to Fluentd input ports, such as in forward on port 24224, to trusted networks using firewall rules. Run Fluentd as a non-root user to prevent writing to sensitive system directories. Filter incoming tags at the input layer to drop any tags containing . or / characters.