Vulnerability record · CVE-2022-39379 · published 2 November 2022
CVE-2022-39379: Fluentd unauthenticated RCE via unsafe JSON deserialization
Fluentd · Fluentd
Fluentd, when the non-default environment variable FLUENT_OJ_OPTION_MODE is set to object, deserializes untrusted JSON payloads unsafely, allowing remote code execution. The flaw is a CWE-502 deserialization issue introduced in version 1.13.2 and patched in 1.15.3. It matters because a network-reachable, unauthenticated attacker can run arbitrary code on affected collectors.
Description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network reachability, no authentication and full code execution impact, plus very high EPSS, makes this a critical patching priority despite the non-default configuration requirement.
What it is
Fluentd, when the non-default environment variable FLUENT_OJ_OPTION_MODE is set to object, deserializes untrusted JSON payloads unsafely, allowing remote code execution. The flaw is a CWE-502 deserialization issue introduced in version 1.13.2 and patched in 1.15.3. It matters because a network-reachable, unauthenticated attacker can run arbitrary code on affected collectors.
Impact
An attacker gains arbitrary code execution on the Fluentd host, with full loss of confidentiality, integrity and availability of the service and its data.
Attack surface
Reached over the network by sending specially crafted JSON payloads to a Fluentd instance; no authentication or user interaction is required per the CVSS vector. Only instances with FLUENT_OJ_OPTION_MODE explicitly set to object are exposed.
Exploitation
Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is high at roughly 0.45 (98.7th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Upgrade Fluentd to version 1.15.3 or later, which contains the patch.
- If immediate upgrade is not possible, remove or unset FLUENT_OJ_OPTION_MODE=object from all Fluentd deployments.
- Audit configurations and deployment manifests for FLUENT_OJ_OPTION_MODE=object and remediate any found.
- Apply the vendor patch commit and Fedora package updates where Fluentd is packaged.
- Restrict network access to Fluentd input ports to trusted sources only.
Detection
- Search Fluentd process environments and configs for FLUENT_OJ_OPTION_MODE=object to identify exposed instances.
- Monitor Fluentd logs for deserialization errors or unexpected object-mode parsing failures.
- Alert on anomalous child processes or outbound connections spawned by the Fluentd service.
- Review network traffic to Fluentd input ports for unusual JSON payload structures.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-39379 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-39379), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
