Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3.

All installations of Fluentd using the out_http plugin with a configuration that permits placeholder expansion are affected, specifically every release before 1.19.3. Products affected include the open‑source Fluentd platform supplied by the vendor fluent. Exact version numbers beyond the mention of versions older19.3 are not listed, but any instance lacking the 1.19.3 upgrade pushes a user into risk.

The CVSS score of 7.2 marks this as a high‑severity vulnerability, reflecting significant potential impact. The EPSS score of < 1% indicates a low but non‑zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires that an attacker can influence the tag placeholder value used by the out_http configuration; if that condition is met, the server can be coerced into making arbitrary HTTP requests, preventing effective mitigation without patching or configuration changes.