Loading vulnerability…
Tag spoofing in Fluent Bit input plugins
CVE-2025-12978 is an improper partial string comparison in the tag_key validation logic of Fluent Bit's in_http, in_splunk, and in_elasticsearch input plugins. The validation does not require an exact tag-key length match, causing a supplied tag-key prefix to be accepted as a complete match. An attacker can spoof a trusted tag and cause records to be processed under an unintended routing label.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the integrity and authenticity of ingested telemetry. An attacker can reroute logs to unintended destinations, bypass tag-dependent filters, inject forged or misleading records under trusted tags, and generate alert floods or otherwise manipulate log routing.
If you can’t patch tonight, do this now.
Until updates are applied, limit network access to Fluent Bit instances and exposed input plugins. Avoid using dynamically derived tags for routing where possible, use static predefined tags, and constrain output destinations and file paths so that manipulated tags cannot affect downstream routing or output behavior.
Patch, then assume compromise.
Upgrade Fluent Bit to version 4.2.0 or later and install the latest vendor release. Fixed releases cited for this group of Fluent Bit issues also include version 4.1.1 and backports in the 4.0 release line; deployments should select the latest supported patched release for their branch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.