Vulnerability · Published Nov 24, 2025 · Assigned by certcc
CVE-2025-12978CVE-2025-12978
Medium 5.4
In plain English
A medium-severity security flaw in Fluent Bit from FluentBit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| FluentBit | Fluent Bit | 0 – before 4.0.12 |