CVE-2026-44025

HIGH 7.5

Fluentd: Exposure of Sensitive Information via Monitor Agent API

CVSS Score

7.5

EPSS Score

0.5%

EPSS Percentile

38th

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agent plugin in_monitor_agent exposes internal metrics and plugin information via a REST API, and responses from /api/plugins.json and related endpoints unintentionally include internal instance variables that may contain database passwords, API keys, or cloud credentials. This issue is fixed in version 1.19.3.

CWE	CWE-306
Vendor	fluent
Product	fluentd
Published	Jul 8, 2026
Last Updated	Jul 9, 2026

Stay Ahead of the Next One

Get instant alerts for fluent fluentd

Be the first to know when new high vulnerabilities affecting fluent fluentd are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

fluent / fluentd

< 1.19.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/fluent/fluentd/security/advisories/GHSA-pr7j-96cj-549h github.com: https://github.com/fluent/fluentd/pull/5392 github.com: https://github.com/fluent/fluentd/commit/990921518971699b9a97441970674d1800e29177 github.com: https://github.com/fluent/fluentd/releases/tag/v1.19.3