Critical Vulnerabilities in Fluent Bit Expose Major Cloud Environments to Exploitation

Five critical vulnerabilities were discovered in Fluent Bit, a widely used open-source telemetry and log collection agent deployed across major cloud providers and AI labs. These flaws, some of which have existed for years, allow attackers to bypass authentication, perform path traversal, achieve remote code execution, cause denial-of-service, and manipulate log tags. The vulnerabilities, identified by Oligo Security, affect all major cloud platforms and have the potential to disrupt cloud services, alter or tamper with data, and enable deeper intrusions into cloud and Kubernetes infrastructure. Fluent Bit is used by tech giants such as Google, Amazon, Oracle, IBM, Microsoft, and OpenAI, with over 15 billion deployments worldwide.

The vulnerabilities include CVE-2025-12972 (path traversal via unsanitized tag values), CVE-2025-12970 (stack buffer overflow in the Docker Metrics input plugin), CVE-2025-12978 (tag-matching logic spoofing), CVE-2025-12977 (improper input validation of tags), and CVE-2025-12969 (missing authentication in the in_forward plugin). Exploiting these flaws could allow attackers to write or overwrite arbitrary files, inject malicious records, reroute logs, and flood security products with false events. The issues have been addressed in Fluent Bit versions v4.1.1 and 4.0.12, and users are urged to update immediately to mitigate risk.