Fluent Bit 5 Critical Vulnerabilities (CVE-2025-12972 etc): RCE, Path Traversal, Auth Bypass

Critical Vulnerability Information 1. Vulnerability Overview Number of Vulnerabilities: 5 critical vulnerabilities Impact: Allows attackers to bypass authentication, perform path traversal, execute remote code, cause denial-of-service conditions, and manipulate tags. 2. Vulnerability Details CVE-2025-12972: Unfiltered tag values used to generate output filenames allow attackers to inject path traversal sequences, write or overwrite arbitrary disk files, and execute arbitrary code under many configurations. CVE-2025-12970: Stack buffer overflow vulnerability in Docker input allows attackers to trigger crashes or execute code by creating containers with excessively long names. CVE-2025-12978: A flaw in Fluent Bit’s tag matching logic enables attackers to spoof trusted tags by guessing only the first character of a tag key, thereby bypassing filters and injecting malicious or misleading records. CVE-2025-12977: Tags derived from user-controlled fields bypass normal sanitization, allowing attackers to inject newlines, path traversal sequences, and control characters, leading to corrupted downstream log parsing, file overwrites, malicious file planting, or remote code execution. CVE-2025-12969: If Fluent Bit forwarder is configured with Security.Users, users can silently disable authentication, enabling remote attackers to send logs, inject falsified telemetry data, or overwhelm detection systems, even though they appear secure. 3. Affected Components and Versions Fluent Bit: Components and versions configured to use insecure tags, file outputs, and plugin settings. 4. Mitigation Measures Upgrade Fluent Bit to the latest stable versions v4.1.1 or v4.0.12 Avoid using dynamic tags for routing configuration Lock output paths and destinations; explicitly set file or file parameters to prevent tag-based path expansion or traversal Run Fluent Bit with minimal privileges Enforce read-only configuration mounts Additional Notes AWS has patched all internal systems relying on Fluent Bit and recommends customers upgrade to the latest version v4.1.1. Fluent Bit is a core component in modern containerized environments. These vulnerabilities highlight how weaknesses in widely deployed components can propagate outward, enabling attackers to hide malicious activities, tamper with data, or even jeopardize infrastructure critical to modern business operations.

Goal Reached Thanks to every supporter — we hit 100%!

Fluent Bit 5 Critical Vulnerabilities (CVE-2025-12972 etc): RCE, Path Traversal, Auth Bypass