Critical [CVE-2026-44024] Remote Code Execution via arbitrary file write due to insufficient tag validation

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on.

Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution.

This issue is fixed in version 1.19.3. A flaw was found in Fluentd, a data collector.

Successful exploitation could lead to a full system compromise without authentication, depending on the Fluentd configuration and its process privileges. Red Hat has determined that no Red Hat product is currently affected by this vulnerability.

Exploitation requires a Fluentd deployment configured with an output plugin, such as out_file, that constructs file paths dynamically from the ${tag} placeholder, combined with the ability for an attacker to submit untrusted, attacker-influenced tags to that Fluentd instance (for example, via an exposed forward or HTTP input).

Deployments that do not accept externally influenced tags, or that do not use tag-based dynamic path construction in output plugin configuration, are not exposed to this issue in practice.