CVE-2026-44024: Fluentd Path Traversal Vulnerability

CVE-2026-44024 Overview

CVE-2026-44024 is a path traversal vulnerability [CWE-22] in Fluentd, an open-source data collector that ingests events from various sources and writes them to files, databases, and cloud services. Versions prior to 1.19.3 allow dynamically constructed file paths using the ${tag} placeholder in output plugin configurations. Insufficient validation of the ${tag} value in file path parameters, such as those used by the out_file plugin, allows attackers to send untrusted tags containing path traversal sequences. This enables writing or overwriting arbitrary files on the host and can lead to remote code execution.

Critical Impact
Attackers can send crafted event tags to traverse directories and overwrite arbitrary files on Fluentd hosts, potentially achieving remote code execution.

Affected Products

Fluentd versions prior to 1.19.3
Deployments using the out_file plugin with ${tag} placeholders in path parameters
Any Fluentd configuration that dynamically constructs file paths from event tags

Discovery Timeline

2026-07-08 - CVE-2026-44024 published to NVD
2026-07-09 - Last updated in NVD database
v1.19.3 - Patch released via Fluentd GitHub release

Technical Details for CVE-2026-44024

Vulnerability Analysis

Fluentd output plugins support dynamic path construction through placeholder substitution. The ${tag} placeholder is replaced at runtime with the tag attached to incoming events. In vulnerable versions, this substitution occurs without enforcing path boundary constraints, so a tag containing .. sequences or absolute path prefixes is directly interpolated into the destination file path.

When Fluentd ingests events from sources that accept externally influenced tags, such as in_forward or HTTP input plugins, an attacker can craft events with malicious tags. The out_file plugin then resolves the path outside the intended output directory. This yields arbitrary file write primitives on the Fluentd host, which can be escalated to remote code execution by overwriting cron jobs, systemd units, shell profiles, or plugin files that Fluentd reloads.

Root Cause

The root cause is missing validation of the substituted ${tag} value against path traversal characters. The chunk key placeholder regular expressions accepted tag content that included ../ and leading path separators. The patched code in lib/fluent/plugin/output.rb introduces explicit patterns to detect and reject invalid path components before file resolution occurs.

Attack Vector

An unauthenticated network-based attacker submits events to a Fluentd input endpoint with a tag value such as ../../../../etc/cron.d/pwn. The output plugin substitutes the tag into the configured path template and writes attacker-controlled event content to the resolved location. No user interaction or privileges are required when the input plugin is exposed on the network.

ruby

// Security patch: enforce strict path boundary validation for tag
      CHUNK_KEY_PLACEHOLDER_PATTERN = /\$\{([-_.@$a-zA-Z0-9]+)\}/
      CHUNK_TAG_PLACEHOLDER_PATTERN = /\$\{(tag(?:\[-?\d+\])?)\}/
      CHUNK_ID_PLACEHOLDER_PATTERN = /\$\{chunk_id\}/
+     INVALID_PATH_COMPONENT_PATTERN = %r{\.\.[/\\]|^[/\\]}
+     PARENT_DIRECTORY_PATTERN = %r{\.\.[/\\]}

      CHUNKING_FIELD_WARN_NUM = 4

Source: Fluentd commit 45c87a8. The patch adds INVALID_PATH_COMPONENT_PATTERN and PARENT_DIRECTORY_PATTERN to reject tags containing .. sequences or leading path separators before they are substituted into file paths.

Detection Methods for CVE-2026-44024

Indicators of Compromise

Files written outside the configured Fluentd output directory, especially in /etc/, /var/spool/cron/, /root/, or user home directories
Event tags in Fluentd logs containing .., /, or \ characters
Unexpected modifications to cron entries, systemd units, or shell startup files on hosts running Fluentd
Fluentd worker processes spawning shell interpreters or writing to non-log directories

Detection Strategies

Inspect Fluentd input logs for tag values matching the regex \.\.[/\\]|^[/\\]
Alert on file writes by the Fluentd process user to paths outside the declared output roots
Correlate in_forward or in_http traffic from untrusted sources with subsequent filesystem changes on the collector host
Validate installed Fluentd version against 1.19.3 across the fleet using software inventory queries

Monitoring Recommendations

Enable file integrity monitoring on directories writable by the Fluentd service account
Forward Fluentd process telemetry, including child process creation and file write events, to a central data lake
Monitor network exposure of Fluentd input ports (default 24224/tcp for forward) and restrict source addresses

How to Mitigate CVE-2026-44024

Immediate Actions Required

Upgrade Fluentd to version 1.19.3 or later on all collectors
Audit output plugin configurations for use of ${tag} in path parameters and other file path fields
Restrict network access to Fluentd input endpoints so only trusted sources can submit events with arbitrary tags
Run Fluentd under a dedicated low-privilege service account with a restricted filesystem scope

Patch Information

The fix is available in Fluentd 1.19.3. See the Fluentd v1.19.3 release notes, the GitHub Security Advisory GHSA-44hj-4m45-frj3, and the pull request implementing the fix. The patch enforces strict path boundary validation for tag substitution in output plugins.

Workarounds

Remove ${tag} placeholders from file path parameters and use static paths or ${chunk_id} where possible
Apply a record_transformer or rewrite_tag_filter upstream to sanitize tags and reject values containing .., /, or \
Terminate Fluentd input on a hardened proxy that validates tag content before forwarding events

bash

# Verify installed Fluentd version and upgrade
fluentd --version
gem install fluentd -v '>= 1.19.3'

# Example sanitizing filter to reject traversal characters in tags
# <filter **>
#   @type grep
#   <exclude>
#     key tag
#     pattern /\.\.[\/\\]|^[\/\\]/
#   </exclude>
# </filter>