Fluentd aggregates events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop, and so on. Before 1.19.3, the Monitor Agent plugin `in_monitor_agent` exposed internal metrics and plugin data via a REST API, and requests to `/api/plugins.json` and related endpoints returned internal instance variables that could contain database passwords, API keys, or cloud credentials. This is a CWE‑306 vulnerability arising from missing authentication for the API, which could expose sensitive internal data. The flaw is fixed in version 1.19.3.

All installations of Fluentd older than 1.19.3 that use the monitor‑agent plugin are impacted. The issue is fixed in v1.19.3; users of 1.19.2 or earlier must update or otherwise disable the plugin.

With a CVSS score of 7.5, this vulnerability is considered high severity. Based on the description, the REST API is accessible without authentication, implying that attackers with network reach to a running Fluentd instance could retrieve credential information via the /api/plugins.json endpoint. The EPSS score of < 1% indicates a very low but nonzero exploitation probability, and the flaw is not listed in CISA's KEV catalog; however, the lack of authentication makes exploitation likely for adversaries with connectivity to the host.