CVE-2026-44161

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44161", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T14:39:34.922Z", "datePublished": "2026-07-08T21:25:43.892Z", "dateUpdated": "2026-07-09T14:40:31.700Z"}, "containers": {"cna": {"title": "Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6gr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6gr"}, {"name": "https://github.com/fluent/fluentd/pull/5394", "tags": ["x_refsource_MISC"], "url": "https://github.com/fluent/fluentd/pull/5394"}, {"name": "https://github.com/fluent/fluentd/commit/c6a01ea2e0ea01977f8d615f7c6dbfae4cba88c9", "tags": ["x_refsource_MISC"], "url": "https://github.com/fluent/fluentd/commit/c6a01ea2e0ea01977f8d615f7c6dbfae4cba88c9"}, {"name": "https://github.com/fluent/fluentd/releases/tag/v1.19.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/fluent/fluentd/releases/tag/v1.19.3"}], "affected": [{"vendor": "fluent", "product": "fluentd", "versions": [{"version": "< 1.19.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T21:25:43.892Z"}, "descriptions": [{"lang": "en", "value": "Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3."}], "source": {"advisory": "GHSA-72f5-rr8c-r6gr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T14:37:57.811738Z", "id": "CVE-2026-44161", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T14:40:31.700Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`", "source": {"advisory": "GHSA-72f5-rr8c-r6gr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "fluent", "product": "fluentd", "versions": [{"status": "affected", "version": "< 1.19.3"}]}], "references": [{"url": "https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6gr", "name": "https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6gr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/fluent/fluentd/pull/5394", "name": "https://github.com/fluent/fluentd/pull/5394", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/fluent/fluentd/commit/c6a01ea2e0ea01977f8d615f7c6dbfae4cba88c9", "name": "https://github.com/fluent/fluentd/commit/c6a01ea2e0ea01977f8d615f7c6dbfae4cba88c9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/fluent/fluentd/releases/tag/v1.19.3", "name": "https://github.com/fluent/fluentd/releases/tag/v1.19.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T21:25:43.892Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44161", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T14:37:57.811738Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-07-09T14:37:58.503Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-44161", "state": "PUBLISHED", "dateUpdated": "2026-07-08T21:25:43.892Z", "dateReserved": "2026-05-05T14:39:34.922Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-08T21:25:43.892Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "fluentd", "vendor": "fluent", "versions": [{"status": "affected", "version": "< 1.19.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:*", "matchCriteriaId": "7AB3C52C-7D3D-4BA5-A8D0-8AC7DA6030EC", "versionEndExcluding": "1.19.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3."}, {"lang": "es", "value": "Fluentd recopila eventos de varias fuentes de datos y los escribe en archivos, RDBMS, NoSQL, IaaS, SaaS, Hadoop, etc. Antes de la versi\u00f3n 1.19.3, el plugin de salida out_http de Fluentd permite marcadores de posici\u00f3n como ${tag} en el par\u00e1metro de configuraci\u00f3n del endpoint, y si un valor de marcador de posici\u00f3n se deriva de una entrada no confiable, un atacante puede controlar el nombre de host de destino de las solicitudes HTTP salientes y forzar solicitudes a servicios internos arbitrarios. Este problema est\u00e1 corregido en la versi\u00f3n 1.19.3."}], "id": "CVE-2026-44161", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44161", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-09T14:37:57.811738Z", "version": "2.0.3"}}]}, "published": "2026-07-08T22:17:14.737", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/fluent/fluentd/commit/c6a01ea2e0ea01977f8d615f7c6dbfae4cba88c9"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/fluent/fluentd/pull/5394"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/fluent/fluentd/releases/tag/v1.19.3"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6gr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.19.3)"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "fluentd", "source": "cna", "vendor": "fluent"}, "product": "fluentd", "vendor": "fluentd"}], "created": "2026-07-09T04:00:11.596741+00:00", "updated": "2026-08-01T15:30:03.754903+00:00", "vendors": ["fluentd", "fluentd$PRODUCT$fluentd"]}