CVE-2026-44025 Fluentd: Exposure of Sensitive Information via Monitor Agent API

What is CVE-2026-44025?

CVE-2026-44025 is a high-severity vulnerability in fluentd, published on 8 Jul 2026.

Official description

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agent plugin in_monitor_agent exposes internal metrics and plugin information via a REST API, and responses from /api/plugins.json and related endpoints unintentionally include internal instance variables that may contain database passwords, API keys, or cloud credentials. This issue is fixed in version 1.19.3.

Weakness: CWE-306

Which versions are affected by CVE-2026-44025?

3 open source packages ship an affected version, including fluentd. It affects 1 product.

Products include Fluentd Fluentd.

How do I fix CVE-2026-44025?

Upgrade fluentd to 1.19.3 or later.

Is CVE-2026-44025 being exploited?

There is no known exploitation of CVE-2026-44025 in the wild and no public exploit code.

Other vulnerabilities in fluentd

• CVE-2026-44024 Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder Critical 9.8
• CVE-2017-10906 Fluentd Escape Sequence Injection Vulnerability Critical 9.8
• CVE-2020-21514 Fluent Fluentd and Fluent-ui use default password High 8.8
• CVE-2026-44160 Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward` High 7.5
• CVE-2026-44161 Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http` High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-fluentd-2026-44025, CLEANSTART-2026-NY24300, CLEANSTART-2026-RT77723, GHSA-pr7j-96cj-549h, MINI-34px-fvxg-6w89, MINI-4v7p-4r55-fjfm and 13 more.