fluent_bit vulnerabilities
CVEs whose affected-version data names the fluent_bit package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2025-12978Medium· 5.4Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching
Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a f…
CVE-2025-12972Medium· 5.3Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names
Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to …
CVE-2025-12969Medium· 6.5Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions
Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with network access to the Fluent Bit instance exposing the for…