Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3.

All installations of Fluentd using the out_http plugin with a configuration that permits placeholder expansion are affected, specifically every release before 1.19.3. Products affected include the open‑source Fluentd platform supplied by the vendor fluent. Exact version numbers beyond the mention of versions older19.3 are not listed, but any instance lacking the 1.19.3 upgrade pushes a user into risk.

With a CVSS score of 7.2, this vulnerability is classified as high severity, indicating significant potential impact on confidentiality and availability. The EPSS score of <1% reflects a low but non-zero likelihood of exploitation, and the issue is not listed in CISA KEV. The vulnerability requires that an attacker can manipulate placeholder values such as ${tag} used in the out_http endpoint configuration; when this occurs, the Fluentd instance will be forced to send outbound HTTP requests to arbitrary hostnames, potentially exposing internal services.