Description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agent plugin in_monitor_agent exposes internal metrics and plugin information via a REST API, and responses from /api/plugins.json and related endpoints unintentionally include internal instance variables that may contain database passwords, API keys, or cloud credentials. This issue is fixed in version 1.19.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| fluent | fluentd | < 1.19.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kube-fluentd-operator | 1.18.2-r72 | — |
| Wolfi rolling | ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesis | 1.19.2.1.1-r5 | — |
| Wolfi rolling | ruby3.2-kube-logging-operator-fluentd-outputs +1 | 6.7.0-r7 | — |
| Wolfi rolling | ruby3.3-fluentd-1.17 +2 | No fix yet | — |
| Wolfi rolling | ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesis +2 | 1.19.3.1.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | fluentd | < 1.19.3 | 1.19.3 | GHSA-pr7j-96cj-549h |
Advisories 1
- WID-SEC-2026-2096 Fluentd: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 8, 2026