CVE-2026-44025 | Fluentd collects events from various data sources and writes… | CVSS 7.5 HIGH

Description

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agent plugin in_monitor_agent exposes internal metrics and plugin information via a REST API, and responses from /api/plugins.json and related endpoints unintentionally include internal instance variables that may contain database passwords, API keys, or cloud credentials. This issue is fixed in version 1.19.3.

Metadata

CVE ID: CVE-2026-44025
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-04 21:24 UTC
Published: 2026-07-08 21:23 UTC
Last updated: 2026-07-08 21:23 UTC
Primary CWE: CWE-306
CWE-306: Missing Authentication for Critical Function
Vendor / Product: fluent / fluentd
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products (1)

Vendor	Product	Platform	Versions
fluent	fluentd	—	< 1.19.3

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	CWE-306: Missing Authentication for Critical Function

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (4)

https://github.com/fluent/fluentd/security/advisories/GHSA-pr7j-96cj-549h https://github.com/fluent/fluentd/security/advisories/GHSA-pr7j-96cj-549h
https://github.com/fluent/fluentd/pull/5392 https://github.com/fluent/fluentd/pull/5392
https://github.com/fluent/fluentd/commit/990921518971699b9a97441970674d1800e29177 https://github.com/fluent/fluentd/commit/990921518971699b9a97441970674d1800e29177
https://github.com/fluent/fluentd/releases/tag/v1.19.3 https://github.com/fluent/fluentd/releases/tag/v1.19.3