Critical [CVE-2026-44024] Remote Code Execution via arbitrary file write due to insufficient tag validation
This critical-severity Red Hat Linux advisory covers CVE-2026-44024.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on.
Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution.
This issue is fixed in version 1.19.3. A flaw was found in Fluentd, a data collector.
Successful exploitation could lead to a full system compromise without authentication, depending on the Fluentd configuration and its process privileges. Red Hat has determined that no Red Hat product is currently affected by this vulnerability.
Exploitation requires a Fluentd deployment configured with an output plugin, such as out_file, that constructs file paths dynamically from the ${tag} placeholder, combined with the ability for an attacker to submit untrusted, attacker-influenced tags to that Fluentd instance (for example, via an exposed forward or HTTP input).
Deployments that do not accept externally influenced tags, or that do not use tag-based dynamic path construction in output plugin configuration, are not exposed to this issue in practice.
- < 1.19.3
Official advisory · high-confidence parse· fetched 3 days ago·verify at source
Mitigation checklist
- Upgrade to Fluentd 1.19.3 or later, which validates the ${tag} placeholder in output plugin path configuration and rejects path traversal characters. Where an immediate upgrade is not possible: avoid using the ${tag} placeholder in file-path-based output plugin configuration (such as the path parameter of out_file); if dynamic tag-based paths are required, restrict allowed tag values with an explicit allowlist/regex filter (for example via a <filter> directive) before they reach the output plugin; and ensure only trusted sources can submit tags to the Fluentd instance by not exposing its forward or HTTP input directly to untrusted networks.
Official advisory · high-confidence parse· fetched 3 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.