Input Plugin Vulnerability in Fluent Bit Affects Data Integrity and Log Routing

CVE-2025-12977

What is CVE-2025-12977?

Fluent Bit's in_http, in_splunk, and in_elasticsearch input plugins are vulnerable due to inadequate sanitization of tag_key inputs. An attacker capable of network access or manipulating records in Splunk or Elasticsearch can introduce tag_key values with special characters, such as newlines or directory traversal sequences (../). This manipulation can lead to serious consequences, including newline injection, path traversal, and forged record injection. The improper handling of tags can ultimately compromise the integrity of data and misroute log outputs, highlighting a critical area of concern for organizations relying on Fluent Bit for log management.

References