CVE-2026-44161 Details

A server-side request forgery (SSRF) vulnerability has been identified in the Fluentd out_http output plugin, affecting versions through 1.19.2. The vulnerability arises from the plugin's allowance of placeholders, such as ${tag}, in the endpoint configuration. If a placeholder value is sourced from untrusted input, an attacker can manipulate the destination hostname of outgoing HTTP requests, redirecting them to arbitrary internal services. This could lead to unauthorized access to internal APIs, data exfiltration, or compromise of cloud metadata endpoints, such as AWS IMDS.

Users should upgrade to Fluentd version 1.19.3 or later, where this vulnerability has been patched. If an immediate upgrade is not possible, avoid using dynamic hostnames in the endpoint parameter, restrict network access to block access to sensitive internal IP addresses, and use firewall rules to prevent the Fluentd node from reaching critical internal services.