CVE-2026-44161

Name of the Vulnerable Software and Affected Versions Fluentd versions prior to 1.19.3

Description The out http output plugin allows the use of placeholders, such as ${tag}, in the endpoint configuration parameter. If a placeholder value is derived from untrusted input, an attacker can control the destination hostname of outbound HTTP requests. This enables a Server-Side Request Forgery (SSRF) attack, where an unauthenticated attacker forces the Fluentd node to send requests to arbitrary internal services, potentially leading to unauthorized access to internal APIs, data exfiltration, or the compromise of cloud metadata endpoints like the AWS IMDS 169.254.169.254.

Recommendations Update to version 1.19.3. Do not use placeholders in the endpoint parameter as a hostname. Use firewall rules to block the Fluentd node from accessing sensitive internal IP addresses, including cloud provider metadata services and internal microservices not required by Fluentd. Inject a filter to explicitly accept only allowed hosts in placeholders.