Input Plugins Flaw in Fluent Bit by Treasure Data

CVE-2025-12978

What is CVE-2025-12978?

Fluent Bit's input plugins, specifically in_http, in_splunk, and in_elasticsearch, exhibit a flaw in the tag_key validation logic. This vulnerability fails to enforce the precise key-length matching requirements, which permits crafted inputs where tag prefixes are mistakenly recognized as complete matches. Remote attackers with either authenticated or exposed access to these input endpoints can exploit this vulnerability, leading to potential manipulation of tags and routing of records to unintended destinations. Such exploitation jeopardizes the authenticity of ingested logs, potentially enabling data injection, alert flooding, and the manipulation of routing logic.

References