CVE-2026-44025CWE-306

Fluentd: Exposure of Sensitive Information via Monitor Agent API

High · published July 8, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agent plugin in_monitor_agent exposes internal metrics and plugin information via a REST API, and responses from /api/plugins.json and related endpoints unintentionally include internal instance variables that may contain database passwords, API keys, or cloud credentials. This issue is fixed in version 1.19.3.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00474 · 40.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-07-08T21:23Z
EPSS history
Timeline
  • 08 JUL 21:23Z
    Fluentd: Exposure of Sensitive Information via Monitor Agent API
    cvelistv5