Image Main

Security researchers at Oligo Security have discovered five vulnerabilities in Fluent Bit, a lightweight, open-source telemetry agent, that could be chained together to compromise and take control of cloud infrastructures.

Fluent Bit is widely used in enterprise environments, and successful exploitation of these flaws could allow attackers to disrupt cloud services, manipulate data, and delve into Kubernetes and cloud infrastructures.

Details of Vulnerabilities

The identified security flaws allow attackers to bypass authentication, perform path traversal, achieve remote code execution (RCE), cause denial of service (DoS) conditions, and manipulate tags. The five vulnerabilities are detailed below:

  • CVE-2025-12972 (Path Traversal): This vulnerability is caused by the use of unsanitized tag values to generate output file names. It allows attackers to write or overwrite arbitrary files on the disk, enabling record manipulation and remote code execution.
  • CVE-2025-12970 (Stack Buffer Overflow): A stack buffer overflow in the Docker Metrics ingress plugin (in_docker). Attackers can cause code execution or crash the agent by creating containers with excessively long names.
  • CVE-2025-12978 (Tag Spoofing): A flaw in the tag matching logic allows attackers to spoof trusted tags (assigned to each event ingested by Fluent Bit) by guessing only the first character of a Tag_Key. This makes it possible to redirect logs, bypass filters, and inject malicious or misleading logs under trusted labels.
  • CVE-2025-12977 (Improper Input Validation): Poor input validation on labels derived from user-controlled fields allows an attacker to inject new lines, traversal sequences, and control characters that can corrupt subsequent records.
  • CVE-2025-12969 (Missing Authentication): The security.users authentication is missing in the in_forward plugin, used to receive logs from other Fluent Bit instances using the Forward protocol. This allows attackers to send logs, inject fake telemetry, and flood security product logs with fake events.

Impact and Consequences

Researchers warn that the magnitude of control these vulnerabilities give an attacker is significant. An attacker could penetrate deep into a cloud environment to execute malicious code via Fluent Bit. Additionally, they could dictate what events are recorded, delete or rewrite incriminating entries to hide their tracks after an attack, and inject fake telemetry or false plausible events to disorient response teams.

The CERT Coordination Center (CERT/CC) also issued a separate warning, noting that many of these vulnerabilities require the attacker to have access to the network of a Fluent Bit instance.

Mitigation and Recommendations

Following responsible disclosure, the vulnerabilities have been fixed in versions 4.1.1 and 4.0.12, released last month. Amazon Web Services (AWS), which participated in the coordinated disclosure, has urged customers using Fluent Bit to update to the latest version for optimal protection.

Other recommended actions include:

  • Avoid using dynamic labels for routing.
  • Block outbound routes and destinations to prevent label-based route expansion or traversal.
  • Mount configuration files and /fluent-bit/etc/ as read-only to prevent runtime manipulation.
  • Run the service as non-root users.

Conclusion

This discovery underscores the importance of keeping critical infrastructure software up to date. Notably, just over a year ago, Tenable detailed another vulnerability in Fluent Bit’s embedded HTTP server (CVE-2024-4323, also known as “Linguistic Lumberjack”) that could be exploited to achieve DoS, information disclosure, or RCE, reinforcing the need for continued vigilance on these types of telemetry agents.

References

  • CVE-2025-12972
  • CVE-2025-12970
  • CVE-2025-12978
  • CVE-2025-12977
  • CVE-2025-12969
  • CVE-2024-4323 (Linguistic Lumberjack)