CVE-2025-12978

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://fluentbit.io/announcements/v4.1.0/	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:*

History

08 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Los plugins de entrada in_http, in_splunk e in_elasticsearch de Fluent Bit contienen una falla en la lógica de validación de tag_key que no logra aplicar la coincidencia exacta de la longitud de la clave. Esto permite entradas manipuladas donde un prefijo de etiqueta se trata incorrectamente como una coincidencia completa. Un atacante remoto con acceso autenticado o expuesto a estos puntos finales de entrada puede explotar este comportamiento para manipular etiquetas y redirigir registros a destinos no deseados. Esto compromete la autenticidad de los registros ingeridos y puede permitir la inyección de datos falsificados, la inundación de alertas y la manipulación del enrutamiento.

Information

Published : 2025-11-24 15:15

Updated : 2026-10-08 10:10

NVD link : CVE-2025-12978

Mitre link : CVE-2025-12978

CVE.ORG link : CVE-2025-12978

JSON object : View

Products Affected

treasuredata

fluent_bit

CWE

NVD-CWE-noinfo

{"id": "CVE-2025-12978", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12978", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-24T15:29:03.000953Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "FluentBit", "product": "Fluent Bit", "versions": [{"status": "affected", "version": "0", "lessThan": "4.0.12", "versionType": "custom"}]}]}], "published": "2025-11-24T15:15:46.873", "references": [{"url": "https://fluentbit.io/announcements/v4.1.0/", "tags": ["Release Notes"], "source": "cret@cert.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation."}, {"lang": "es", "value": "Los plugins de entrada in_http, in_splunk e in_elasticsearch de Fluent Bit contienen una falla en la l\u00f3gica de validaci\u00f3n de tag_key que no logra aplicar la coincidencia exacta de la longitud de la clave. Esto permite entradas manipuladas donde un prefijo de etiqueta se trata incorrectamente como una coincidencia completa. Un atacante remoto con acceso autenticado o expuesto a estos puntos finales de entrada puede explotar este comportamiento para manipular etiquetas y redirigir registros a destinos no deseados. Esto compromete la autenticidad de los registros ingeridos y puede permitir la inyecci\u00f3n de datos falsificados, la inundaci\u00f3n de alertas y la manipulaci\u00f3n del enrutamiento."}], "lastModified": "2026-10-08T10:10:00.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D0EA105-B741-4E44-828A-9300B09A7A79"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}