CVE-2026-44161CWE-918

Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`

High · published July 8, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
37.4
In the wild
Unconfirmed
What it is

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00442 · 37.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-08T21:25Z
EPSS history
Timeline
  • 08 JUL 21:25Z
    Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`
    cvelistv5