CVE-2026-44024: Fluent Fluentd path traversal in ${tag} placeholder

CVE-2026-44024 · Severity: critical · CVSS 9.8 · Published 2026-07-08

Fluentd is a popular data collection tool used to gather logs and events from various sources and route them to storage or analysis platforms. A critical vulnerability allows attackers to manipulate how Fluentd names the files it creates, potentially allowing them to write or overwrite any file on the server. This could lead to a complete system takeover, data loss, or service disruption, especially if Fluentd is configured to receive data from untrusted networks.

Technologies: fluentd (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-44024 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44024 being exploited in the wild.
How severe is CVE-2026-44024?
Critical severity, with a CVSS score of 9.8, published 8 July 2026.
Which products and versions are affected?
fluentd (RubyGems) <= 1.19.2, ECOSYSTEM:introduced=0,fixed=1.19.3.
Is there a fix for CVE-2026-44024?
Yes. fluentd (RubyGems): upgrade to 1.19.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44024 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44024?
Check whether you run fluentd (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fluentd (RubyGems): upgrade to 1.19.3 or later
    bundle update fluentd

Technical details

A path traversal vulnerability (CWE-22) exists in Fluentd's 'extract_placeholders' method. When the '${tag}' placeholder is used in output plugin configurations (such as 'out_file'), Fluentd fails to sufficiently validate the tag string for directory traversal sequences like '../' or absolute paths. An unauthenticated remote attacker can send specially crafted events with malicious tags to write or overwrite arbitrary files on the filesystem. Depending on the environment and process privileges, this can be escalated to remote code execution by overwriting executable files or configuration scripts. The fix, introduced in version 1.19.3, implements strict path boundary validation for the tag variable.

Affected products

  • Fluent Fluentd < 1.19.3

Identifiers

  • CVE-2026-44024
  • GHSA-44hj-4m45-frj3

Timeline

  • 2026-06-25: patched: Fix merged and version 1.19.3 released.
  • 2026-06-26: advisory: GitHub Security Advisory GHSA-44hj-4m45-frj3 published.
  • 2026-07-08: disclosed: CVE-2026-44024 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.