Fluentd collects events from various data sources and writes them to files, relational and NoSQL databases, cloud services, and Hadoop. Prior to 1.19.3, its Monitor Agent plugin in_monitor_agent exposed internal metrics and plugin information via a REST API. Responses from /api/plugins.json and related endpoints unintentionally included internal instance variables that could contain database passwords, API keys, or cloud credentials. An attacker who can reach that endpoint can retrieve sensitive data. This vulnerability is CWE‑306.

All installations of Fluentd older than 1.19.3 that use the monitor‑agent plugin are impacted. The issue is fixed in v1.19.3; users of 1.19.2 or earlier must update or otherwise disable the plugin.

With a CVSS score of 7.5, this vulnerability is considered high severity. Based on the description, the REST API is accessible without authentication, implying that attackers with network reach to a running Fluentd instance could retrieve credential information via the /api/plugins.json endpoint. The EPSS score of < 1% indicates a very low but nonzero exploitation probability, and the flaw is not listed in CISA's KEV catalog; however, the lack of authentication makes exploitation likely for adversaries with connectivity to the host.