CVE-2025-12978 Overview
CVE-2025-12978 affects Fluent Bit, an open-source log processor and forwarder maintained by Treasure Data. The in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. A crafted input causes a tag prefix to be treated as a full match. An authenticated or otherwise exposed remote attacker can abuse this behavior to manipulate tags and redirect records to unintended destinations. The result is compromised log authenticity, forged data injection, alert flooding, and routing manipulation.
Critical Impact
Attackers with access to exposed Fluent Bit input endpoints can forge log tags, redirect telemetry to unintended outputs, and pollute downstream detection pipelines.
Affected Products
- Treasure Data Fluent Bit 4.1.0 (in_http input plugin)
- Treasure Data Fluent Bit 4.1.0 (in_splunk input plugin)
- Treasure Data Fluent Bit 4.1.0 (in_elasticsearch input plugin)
Discovery Timeline
- 2025-11-24 - CVE-2025-12978 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12978
Vulnerability Analysis
Fluent Bit input plugins support a tag_key option that lets clients override the record tag by naming a field in the incoming payload. The tag drives routing decisions to output plugins such as Elasticsearch, S3, Kafka, and Splunk. The affected plugins compare the configured tag_key against incoming keys using a prefix comparison instead of an exact, length-aware match.
Any key whose leading characters match the configured tag_key satisfies the check. An attacker can submit records containing crafted key names that pass validation and then substitute an attacker-controlled tag value. Downstream routing rules apply the forged tag, sending records to outputs that would normally be reserved for trusted sources.
The issue is classified as an input validation weakness ([NVD-CWE-noinfo]). Confidentiality is not affected, but integrity and availability of the log pipeline are.
Root Cause
The root cause is missing length enforcement in the string comparison used to resolve the tag_key field. A comparison such as strncmp or an equivalent prefix check accepts any key whose first N bytes equal the configured key. The absence of a trailing null-byte or explicit length check allows collisions between the legitimate tag field and attacker-supplied keys with the same prefix.
Attack Vector
Exploitation requires network access to a Fluent Bit HTTP, Splunk HEC, or Elasticsearch-compatible input endpoint. Where these endpoints are exposed to untrusted networks or shared among tenants, an attacker sends a JSON record containing a key that shares a prefix with the configured tag_key. The plugin then treats the attacker-controlled value as the record tag. The forged tag can match routing filters intended for trusted sources, redirecting logs to sensitive outputs or flooding alerting pipelines with fabricated events.
See the Fluent Bit v4.1.0 Announcement for release-level context on the affected build.
Detection Methods for CVE-2025-12978
Indicators of Compromise
- Unexpected spikes in records bearing tags that would normally originate from a small, trusted set of sources.
- Records arriving at HTTP, Splunk HEC, or Elasticsearch input endpoints containing keys that share a prefix with the configured tag_key.
- Downstream output destinations receiving records from source IP addresses or client identities that have never previously written to that route.
Detection Strategies
- Enable Fluent Bit debug or trace logging on in_http, in_splunk, and in_elasticsearch and audit resolved tags against expected client-to-tag mappings.
- Compare tag distributions before and after the plugin against a baseline; deviation indicates possible tag manipulation.
- Correlate ingress records with authenticated client identity where available, and flag records where the resolved tag does not match the identity's authorized set.
Monitoring Recommendations
- Alert on new or unexpected tag values appearing in output routes that feed alerting or SIEM pipelines.
- Rate-limit and monitor request volumes on exposed Fluent Bit input ports to detect alert flooding attempts.
- Track configuration drift on Fluent Bit deployments and record the running version to identify hosts still on 4.1.0.
How to Mitigate CVE-2025-12978
Immediate Actions Required
- Upgrade Fluent Bit to a release beyond 4.1.0 that includes the exact-length tag_key validation fix, per the Fluent Bit v4.1.0 Announcement and subsequent releases.
- Restrict network exposure of in_http, in_splunk, and in_elasticsearch endpoints to trusted sources only using firewall rules, network policies, or service mesh authorization.
- Enforce authentication on all Fluent Bit input plugins and rotate any shared tokens that may have been exposed.
Patch Information
Treasure Data addresses the flaw in Fluent Bit versions released after 4.1.0. Confirm the fixed version through the vendor's release notes and upgrade both container images and host installations. Rebuild any downstream images that bundle Fluent Bit as a sidecar or DaemonSet.
Workarounds
- Where upgrade is not immediately possible, disable the tag_key option on in_http, in_splunk, and in_elasticsearch and rely on the static tag configured per input.
- Place a reverse proxy in front of Fluent Bit input endpoints to strip or validate keys in incoming JSON payloads before they reach the plugin.
- Segregate multi-tenant Fluent Bit deployments so that each tenant writes to a dedicated input instance with its own static tag.
# Configuration example: remove tag_key and enforce a static tag per input
[INPUT]
Name http
Listen 0.0.0.0
Port 9880
Tag trusted.http.ingest
# tag_key <-- omit to prevent client-controlled tagging
[INPUT]
Name splunk
Listen 0.0.0.0
Port 8088
Tag trusted.splunk.ingest
[INPUT]
Name elasticsearch
Listen 0.0.0.0
Port 9200
Tag trusted.es.ingest
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
