CVE-2025-12977

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special characters such as newlines or ../ that are treated as valid tags. Because tags influence routing and some outputs derive filenames or contents from tags, this can allow newline injection, path traversal, forged record injection, or log misrouting, impacting data integrity and log routing.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/
https://www.oligo.security/blog/critical-vulnerabilities-in-fluent-bit-expose-cloud-environments-to-remote-takeover

Configurations

Configuration 1 (hide)

cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Los complementos de entrada in_http, in_splunk e in_elasticsearch de Fluent Bit no logran sanear las entradas tag_key. Un atacante con acceso a la red o la capacidad de escribir registros en Splunk o Elasticsearch puede proporcionar valores tag_key que contengan caracteres especiales como saltos de línea o ../ que son tratados como etiquetas válidas. Debido a que las etiquetas influyen en el enrutamiento y algunas salidas derivan nombres de archivo o contenidos de las etiquetas, esto puede permitir la inyección de saltos de línea, el salto de ruta, la inyección de registros falsificados o el enrutamiento incorrecto de registros, lo que afecta la integridad de los datos y el enrutamiento de los registros.

Information

Published : 2025-11-24 15:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-12977

Mitre link : CVE-2025-12977

CVE.ORG link : CVE-2025-12977

JSON object : View

Products Affected

treasuredata

fluent_bit

CWE

CWE-1287

Improper Validation of Specified Type of Input

{"id": "CVE-2025-12977", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12977", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-24T19:12:43.890288Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "FluentBit", "product": "Fluent Bit", "versions": [{"status": "affected", "version": "0", "lessThan": "4.0.12", "versionType": "custom"}]}]}], "published": "2025-11-24T15:15:46.770", "references": [{"url": "https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/", "source": "cret@cert.org"}, {"url": "https://www.oligo.security/blog/critical-vulnerabilities-in-fluent-bit-expose-cloud-environments-to-remote-takeover", "source": "cret@cert.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-1287"}]}], "descriptions": [{"lang": "en", "value": "Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special characters such as newlines or ../ that are treated as valid tags. Because tags influence routing and some outputs derive filenames or contents from tags, this can allow newline injection, path traversal, forged record injection, or log misrouting, impacting data integrity and log routing."}, {"lang": "es", "value": "Los complementos de entrada in_http, in_splunk e in_elasticsearch de Fluent Bit no logran sanear las entradas tag_key. Un atacante con acceso a la red o la capacidad de escribir registros en Splunk o Elasticsearch puede proporcionar valores tag_key que contengan caracteres especiales como saltos de l\u00ednea o ../ que son tratados como etiquetas v\u00e1lidas. Debido a que las etiquetas influyen en el enrutamiento y algunas salidas derivan nombres de archivo o contenidos de las etiquetas, esto puede permitir la inyecci\u00f3n de saltos de l\u00ednea, el salto de ruta, la inyecci\u00f3n de registros falsificados o el enrutamiento incorrecto de registros, lo que afecta la integridad de los datos y el enrutamiento de los registros."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D0EA105-B741-4E44-828A-9300B09A7A79"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}