CVE-2025-12978: Medium severity Fluent Bit Fluent Bit vulnerability
Fluent Bit inhttp, insplunk, and inelasticsearch input plugins contain a flaw in the tagkey validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12978?
CVE-2025-12978 is a medium-severity vulnerability due to its potential for remote exploitation with authenticated access.
How do I fix CVE-2025-12978?
To fix CVE-2025-12978, update Fluent Bit to the latest version that contains the patch addressing the tag_key validation flaw.
What are the affected components of CVE-2025-12978?
CVE-2025-12978 affects the in_http, in_splunk, and in_elasticsearch input plugins of Fluent Bit.
Who can exploit CVE-2025-12978?
CVE-2025-12978 can be exploited by remote attackers who are authenticated to the Fluent Bit service.
What impact does CVE-2025-12978 have on Fluent Bit?
CVE-2025-12978 may allow attackers to manipulate tag processing due to improper key-length matching, potentially leading to data misclassification.