CVE-2026-44024

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44024", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-04T21:24:36.506Z", "datePublished": "2026-07-08T21:20:29.598Z", "dateUpdated": "2026-07-10T03:55:45.194Z"}, "containers": {"cna": {"title": "Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3"}, {"name": "https://github.com/fluent/fluentd/pull/5391", "tags": ["x_refsource_MISC"], "url": "https://github.com/fluent/fluentd/pull/5391"}, {"name": "https://github.com/fluent/fluentd/commit/45c87a81f3ac0b72b3f9dcfe8cfb5f9038f81437", "tags": ["x_refsource_MISC"], "url": "https://github.com/fluent/fluentd/commit/45c87a81f3ac0b72b3f9dcfe8cfb5f9038f81437"}, {"name": "https://github.com/fluent/fluentd/releases/tag/v1.19.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/fluent/fluentd/releases/tag/v1.19.3"}], "affected": [{"vendor": "fluent", "product": "fluentd", "versions": [{"version": "< 1.19.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T21:20:29.598Z"}, "descriptions": [{"lang": "en", "value": "Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution. This issue is fixed in version 1.19.3."}], "source": {"advisory": "GHSA-44hj-4m45-frj3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-44024"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T03:55:45.194Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44024", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-09T13:26:40.473209Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T13:26:47.715Z"}}], "cna": {"title": "Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder", "source": {"advisory": "GHSA-44hj-4m45-frj3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "fluent", "product": "fluentd", "versions": [{"status": "affected", "version": "< 1.19.3"}]}], "references": [{"url": "https://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3", "name": "https://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/fluent/fluentd/pull/5391", "name": "https://github.com/fluent/fluentd/pull/5391", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/fluent/fluentd/commit/45c87a81f3ac0b72b3f9dcfe8cfb5f9038f81437", "name": "https://github.com/fluent/fluentd/commit/45c87a81f3ac0b72b3f9dcfe8cfb5f9038f81437", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/fluent/fluentd/releases/tag/v1.19.3", "name": "https://github.com/fluent/fluentd/releases/tag/v1.19.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution. This issue is fixed in version 1.19.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T21:20:29.598Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44024", "state": "PUBLISHED", "dateUpdated": "2026-07-09T13:26:53.271Z", "dateReserved": "2026-05-04T21:24:36.506Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-08T21:20:29.598Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "fluentd", "vendor": "fluent", "versions": [{"status": "affected", "version": "< 1.19.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:*", "matchCriteriaId": "7AB3C52C-7D3D-4BA5-A8D0-8AC7DA6030EC", "versionEndExcluding": "1.19.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution. This issue is fixed in version 1.19.3."}, {"lang": "es", "value": "Fluentd recopila eventos de varias fuentes de datos y los escribe en archivos, RDBMS, NoSQL, IaaS, SaaS, Hadoop, etc. Antes de la versi\u00f3n 1.19.3, Fluentd permite la construcci\u00f3n din\u00e1mica de rutas de archivo utilizando el marcador de posici\u00f3n ${tag}, y la validaci\u00f3n insuficiente de ${tag} en configuraciones de archivo, como el par\u00e1metro path del plugin out_file, permite a los atacantes que env\u00edan etiquetas no confiables que contienen caracteres de salto de ruta escribir o sobrescribir archivos arbitrarios y potencialmente lograr la ejecuci\u00f3n remota de c\u00f3digo. Este problema est\u00e1 solucionado en la versi\u00f3n 1.19.3."}], "id": "CVE-2026-44024", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44024", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-09T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-07-08T22:17:14.337", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/fluent/fluentd/commit/45c87a81f3ac0b72b3f9dcfe8cfb5f9038f81437"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/fluent/fluentd/pull/5391"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/fluent/fluentd/releases/tag/v1.19.3"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "fluentd: Fluentd: Remote Code Execution via arbitrary file write due to insufficient tag validation", "id": "2498282", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498282"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution. This issue is fixed in version 1.19.3.", "A flaw was found in Fluentd, a data collector. This vulnerability allows a remote attacker to achieve arbitrary file write and potentially remote code execution by sending untrusted tags containing path traversal characters. The issue arises from insufficient validation of the ${tag} placeholder in file configurations, such as the path parameter of the out_file plugin. Successful exploitation could lead to a full system compromise without authentication, depending on the Fluentd configuration and its process privileges."], "mitigation": {"lang": "en:us", "value": "Upgrade to Fluentd 1.19.3 or later, which validates the ${tag} placeholder in output plugin path configuration and rejects path traversal characters. Where an immediate upgrade is not possible: avoid using the ${tag} placeholder in file-path-based output plugin configuration (such as the path parameter of out_file); if dynamic tag-based paths are required, restrict allowed tag values with an explicit allowlist/regex filter (for example via a <filter> directive) before they reach the output plugin; and ensure only trusted sources can submit tags to the Fluentd instance by not exposing its forward or HTTP input directly to untrusted networks."}, "name": "CVE-2026-44024", "public_date": "2026-07-08T21:20:29Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-44024\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44024\nhttps://github.com/fluent/fluentd/commit/45c87a81f3ac0b72b3f9dcfe8cfb5f9038f81437\nhttps://github.com/fluent/fluentd/pull/5391\nhttps://github.com/fluent/fluentd/releases/tag/v1.19.3\nhttps://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3"], "statement": "Red Hat has determined that no Red Hat product is currently affected by this vulnerability. Exploitation requires a Fluentd deployment configured with an output plugin, such as out_file, that constructs file paths dynamically from the ${tag} placeholder, combined with the ability for an attacker to submit untrusted, attacker-influenced tags to that Fluentd instance (for example, via an exposed forward or HTTP input). Deployments that do not accept externally influenced tags, or that do not use tag-based dynamic path construction in output plugin configuration, are not exposed to this issue in practice. Red Hat has completed a portfolio-wide search for Fluentd across Red Hat product offerings (strict and substring dependency search) and found no currently supported Red Hat product that ships the vulnerable code path.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.19.3)"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "fluentd", "source": "cna", "vendor": "fluent"}, "product": "fluentd", "vendor": "fluentd"}], "created": "2026-07-09T09:15:05.513760+00:00", "updated": "2026-08-03T04:45:03.903655+00:00", "vendors": ["fluentd", "fluentd$PRODUCT$fluentd"]}