Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2026-44024 BIT-fluentd-2026-44024EUVD-2026-42436GHSA-44hj-4m45-frj3

Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

Published Jul 8, 2026 · Updated Jul 10, 2026 · Assigned by GitHub_M

Vendor: fluent Product: fluentd Package: fluentd Package: kube-fluentd-operator Package: ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesis Package: ruby3.2-kube-logging-operator-fluentd-outputs Package: ruby3.3-fluentd-1.17 Package: ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesis Package: ruby3.4-fluentd-1.17 Package: ruby3.4-fluentd-kubernetes-daemonset-1.19-kinesis Package: ruby3.4-kube-logging-operator-fluentd-outputs Package: ruby4.0-fluentd-1.17 Package: ruby4.0-fluentd-kubernetes-daemonset-1.19-kinesis Ecosystem: RubyGems Ecosystem: Wolfi

Description

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution. This issue is fixed in version 1.19.3.

Affected products

VendorProductAffectedFixed
fluent fluentd < 1.19.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling kube-fluentd-operator 1.18.2-r72 —
Wolfi rolling ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesis 1.19.2.1.1-r5 —
Wolfi rolling ruby3.2-kube-logging-operator-fluentd-outputs +1 6.7.0-r7 —
Wolfi rolling ruby3.3-fluentd-1.17 +2 No fix yet —
Wolfi rolling ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesis +2 1.19.3.1.0-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems fluentd < 1.19.3 1.19.3 GHSA-44hj-4m45-frj3

Advisories 3

References