Remote Code Execution Vulnerability in Fluent Bit by Treasure Data

CVE-2026-61674

What is CVE-2026-61674?

Fluent Bit, a lightweight processor for logs, metrics, and traces, has a vulnerability in the out_forward plugin affecting versions from 0.11.0 to 5.0.8. The issue arises when the secure_forward_pong function duplicates server-controlled data into a 32-byte stack buffer without adequate checks on the MessagePack type or length. This flaw can allow an attacker who can impersonate the Secure Forward destination to send an oversized payload during the handshake process, potentially leading to stack control data overwrites. Unprotected builds without stack canaries may allow remote code execution under the context of the Fluent Bit process user. When using opt-in supervisor mode, it is possible for an attacker to exploit this behavior repeatedly to achieve code execution, while ordinary service restarts will not retain the vulnerable state. The vulnerability has been addressed in version 5.0.8.

References