Authentication Bypass in Fluent Bit's In_forward Input Plugin
CVE-2025-12969

6.5MEDIUM

Key Information:

Vendor

Fluentbit

Status
Fluent Bit
Vendor
CVE Published:
24 November 2025

What is CVE-2025-12969?

A security flaw in Fluent Bit's in_forward input plugin allows unauthorized users to bypass the security.authentication mechanism under specific configuration settings. This vulnerability enables remote attackers with network access to exploit the Fluent Bit instance, potentially injecting unauthenticated data. By circumventing established authentication controls, attackers may insert forged log records, disrupt alerting systems, or alter routing decisions, jeopardizing the authenticity and integrity of the logs being ingested.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Fluent Bit 0 < 4.0.13

References

https://fluentbit.io/blog/2025/10/28/security-vulnerabili...
https://www.oligo.security/blog/critical-vulnerabilities-...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.