Loading vulnerability…
Improper tag_key sanitization in Fluent Bit in_http, in_splunk, and in_elasticsearch
CVE-2025-12977 is an improper input validation vulnerability in Fluent Bit affecting the in_http, in_splunk, and in_elasticsearch input plugins. When Fluent Bit is configured to derive record tags from user-controlled fields via the tag_key option, the resulting tag values bypass normal sanitization. An attacker with network access to the HTTP input, or the ability to write records into Splunk or Elasticsearch feeding Fluent Bit, can supply tag_key values containing special characters such as newlines, control characters, or path traversal sequences like ../. Because Fluent Bit tags are used for routing and some downstream outputs derive filenames or content from tags, maliciously crafted tags can be accepted as valid and propagated through the pipeline, enabling downstream injection and routing abuse.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise log and telemetry integrity by causing log misrouting, forged record injection, newline injection into downstream logs, and path traversal effects in configurations where outputs derive filenames or content from tags. In affected deployments this can let an attacker tamper with or corrupt downstream logs, redirect records to unintended destinations, and support broader output-based attacks. The provided context assigns CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impact with no required user interaction.
If you can’t patch tonight, do this now.
If immediate patching is not possible, avoid deriving routing decisions from dynamic user-controlled tags. Prefer static predefined tags, and lock down output paths and destinations by explicitly setting fixed Path/File parameters so tags are not expanded into filesystem paths or output content. Restrict network exposure of Fluent Bit instances and exposed input plugins, mount /fluent-bit/etc/ and configuration files read-only to prevent runtime tampering, run Fluent Bit as a non-root user with minimal filesystem permissions, and increase monitoring for suspicious tag values, log-routing anomalies, forged telemetry, and unexpected file writes.
Patch, then assume compromise.
Upgrade Fluent Bit to a fixed release. The provided sources indicate fixes were released in the 4.x line, with references variously stating 4.1.1 and 4.0.12, and other advisory material stating fixes are in 4.2/4.1.1 and backported to 4.0.14. Based on the supplied content, the safe recommendation is to update to the latest vendor-supported release at or above the patched versions available from Fluent Bit. In addition, ensure strict validation and sanitization of tag_key-derived values so tags cannot contain control characters, newline characters, traversal sequences, or other unsafe characters.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.