CVE-2025-12969

Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with network access to the Fluent Bit instance exposing the forward input to send unauthenticated data. By bypassing authentication controls, attackers can inject forged log records, flood alerting systems, or manipulate routing decisions, compromising the authenticity and integrity of ingested logs.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/
https://www.oligo.security/blog/critical-vulnerabilities-in-fluent-bit-expose-cloud-environments-to-remote-takeover

Configurations

Configuration 1 (hide)

cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:*

History

08 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) El plugin de entrada in_forward de Fluent Bit no aplica correctamente el mecanismo de autenticación security.users bajo ciertas condiciones de configuración. Esto permite a atacantes remotos con acceso de red a la instancia de Fluent Bit que expone la entrada forward enviar datos no autenticados. Al eludir los controles de autenticación, los atacantes pueden inyectar registros de logs falsificados, inundar sistemas de alerta o manipular decisiones de enrutamiento, comprometiendo la autenticidad y la integridad de los logs ingeridos.

Information

Published : 2025-11-24 15:15

Updated : 2026-10-08 10:10

NVD link : CVE-2025-12969

Mitre link : CVE-2025-12969

CVE.ORG link : CVE-2025-12969

JSON object : View

Products Affected

treasuredata

fluent_bit

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-12969", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12969", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-24T18:02:22.489781Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "FluentBit", "product": "Fluent Bit", "versions": [{"status": "affected", "version": "0", "lessThan": "4.0.13", "versionType": "custom"}]}]}], "published": "2025-11-24T15:15:46.380", "references": [{"url": "https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/", "source": "cret@cert.org"}, {"url": "https://www.oligo.security/blog/critical-vulnerabilities-in-fluent-bit-expose-cloud-environments-to-remote-takeover", "source": "cret@cert.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with network access to the Fluent Bit instance exposing the forward input to send unauthenticated data. By bypassing authentication controls, attackers can inject forged log records, flood alerting systems, or manipulate routing decisions, compromising the authenticity and integrity of ingested logs."}, {"lang": "es", "value": "El plugin de entrada in_forward de Fluent Bit no aplica correctamente el mecanismo de autenticaci\u00f3n security.users bajo ciertas condiciones de configuraci\u00f3n. Esto permite a atacantes remotos con acceso de red a la instancia de Fluent Bit que expone la entrada forward enviar datos no autenticados. Al eludir los controles de autenticaci\u00f3n, los atacantes pueden inyectar registros de logs falsificados, inundar sistemas de alerta o manipular decisiones de enrutamiento, comprometiendo la autenticidad y la integridad de los logs ingeridos."}], "lastModified": "2026-10-08T10:10:00.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D0EA105-B741-4E44-828A-9300B09A7A79"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}