Loading vulnerability…
Authentication bypass in Fluent Bit in_forward plugin
CVE-2025-12969 is an authentication bypass vulnerability in Fluent Bit's in_forward input plugin. Under certain configuration conditions, specifically when the forward input is configured with Security.Users authentication without the required Shared_Key, the plugin does not properly enforce authentication and silently accepts data without validating credentials. As a result, a Fluent Bit instance that appears to be protected by username/password authentication can in fact receive unauthenticated Forward protocol messages from remote sources. The flaw affects the integrity and trustworthiness of ingested telemetry by allowing forged log and event data to be submitted to the pipeline.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker with network access to the exposed in_forward listener can send unauthenticated log records and telemetry into the Fluent Bit pipeline. This can be used to inject forged records, flood alerting or detection systems with false events, manipulate routing decisions that depend on tags or record content, and generally compromise the authenticity and integrity of collected logs. In environments that rely on Fluent Bit for security monitoring or incident response, this can mislead defenders, obscure malicious activity, and degrade confidence in downstream analytics.
If you can’t patch tonight, do this now.
Until patching is completed, restrict network access to Fluent Bit instances exposing the in_forward plugin, especially the default Forward protocol listener on TCP/TLS port 24224. Do not rely on Security.Users alone in vulnerable versions where authentication may be silently disabled. Limit exposure to trusted senders only using network ACLs, firewall rules, segmentation, or mTLS/TLS-based controls where available. Increase monitoring for unexpected forward traffic, anomalous log injection, alert flooding, and suspicious telemetry originating from untrusted sources.
Patch, then assume compromise.
Upgrade Fluent Bit to a fixed release. The provided sources indicate the issue was addressed in Fluent Bit 4.1.1 and 4.0.12, with additional references stating fixes are present in 4.2 and backported to 4.0.14. At minimum, deploy the latest vendor-supported release that includes the fix for CVE-2025-12969 and verify that forward authentication is functioning as intended after upgrade. Review all in_forward configurations that use Security.Users and ensure they conform to vendor guidance, including use of the required Shared_Key where applicable.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.