Description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| fluent | fluentd | < 1.19.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kube-fluentd-operator | 1.18.2-r72 | — |
| Wolfi rolling | ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesis | 1.19.2.1.1-r5 | — |
| Wolfi rolling | ruby3.2-kube-logging-operator-fluentd-outputs +1 | 6.7.0-r7 | — |
| Wolfi rolling | ruby3.3-fluentd-1.17 +2 | No fix yet | — |
| Wolfi rolling | ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesis +2 | 1.19.3.1.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | fluentd | < 1.19.3 | 1.19.3 | GHSA-72f5-rr8c-r6gr |
Advisories 2
- WID-SEC-2026-4084 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2026
- WID-SEC-2026-2096 Fluentd: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 8, 2026