Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3.

An update of the rubygem package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS,
    Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag}
    in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an
    attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary
    internal services. This issue is fixed in version 1.19.3. (CVE-2026-44161)

ID	Name	Product	Family	Type	Severity
333802	Photon OS 5.0: Rubygem PHSA-2026-5.0-92-0927	Nessus	PhotonOS Local Security Checks	Local	critical
329206	Photon OS 5.0: Rubygem PHSA-2026-5.0-0927	Nessus	PhotonOS Local Security Checks	Local	critical
444010	SCA: security update for fluentd (GHSA-72f5-rr8c-r6gr)	Tenable Cloud Security	SCA Checks	Local	high
444010	SCA: security update for fluentd (GHSA-72f5-rr8c-r6gr)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-44161

high

Tenable Plugins

critical

critical

high

high