CVE-2026-61674: Fluent Bit RCE Vulnerability

CVE-2026-61674 Overview

CVE-2026-61674 is a stack buffer overflow [CWE-121] in Fluent Bit, the logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. The flaw affects versions from 0.11.0 through 5.0.7 in the plugins/out_forward/forward.c module. The secure_forward_pong function copies a server-controlled PONG[2] reason field into a 32-byte stack buffer using memcpy without validating the MessagePack type or length. An attacker who controls or impersonates a Secure Forward destination can overwrite stack control data during the initial handshake. Fluent Bit 5.0.8 fixes the issue.

Critical Impact

Remote attackers impersonating a Secure Forward destination can crash the Fluent Bit process or achieve remote code execution as the Fluent Bit user on builds without stack canaries or with disclosure primitives.

Affected Products

• Fluent Bit versions 0.11.0 through 5.0.7
• Deployments using the out_forward plugin configured with Shared_Key or Empty_Shared_Key
• Fluent Bit instances running with the opt-in --supervisor mode (elevated exploitability)

Discovery Timeline

• 2026-09-21 - CVE-2026-61674 published to the National Vulnerability Database
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-61674

Vulnerability Analysis

The vulnerability resides in the secure_forward_pong handler inside plugins/out_forward/forward.c. During the Secure Forward handshake, the server sends a PONG message whose third element (PONG[2]) carries a human-readable reason string. Fluent Bit copies that value directly into a fixed 32-byte stack buffer named msg using memcpy, without checking the MessagePack element type or its declared length. A server that returns an oversized or type-confused reason writes past the buffer and corrupts adjacent stack frame data, including saved registers and the return address.

Hardened builds compiled with stack canaries reliably abort on corruption, producing a denial-of-service condition. Builds without a canary, or those combined with a memory disclosure primitive, permit arbitrary code execution as the Fluent Bit process user. The --supervisor opt-in mode compounds the risk. Fork-only respawns preserve the parent's canary value and address-space layout, letting an attacker perform repeated crash-or-survive probes against hardened builds until code execution succeeds.

Root Cause

The root cause is missing input validation on attacker-controlled MessagePack data before a length-unchecked memcpy into a fixed-size stack buffer. The handler trusts the peer to send a well-formed reason field of at most 32 bytes.

Attack Vector

Exploitation requires an attacker to control or impersonate the upstream Secure Forward server that a Fluent Bit client connects to. The attack is delivered over the network during the first handshake, before authentication of the peer completes. No user interaction is required on the victim host. See the GitHub Security Advisory GHSA-jrp8-r9hx-gf73 and the upstream fix commit for the technical patch details.

Detection Methods for CVE-2026-61674

Indicators of Compromise

• Unexpected crashes, SIGABRT events, or stack-smashing terminations reported by the Fluent Bit process
• Repeated respawn cycles when Fluent Bit is running under --supervisor mode
• Outbound out_forward TCP sessions to unexpected or newly observed upstream endpoints
• Malformed MessagePack PONG frames on Forward protocol connections, particularly with oversized third elements

Detection Strategies

• Inventory Fluent Bit deployments and flag any instance below version 5.0.8 that loads the out_forward plugin with Shared_Key or Empty_Shared_Key
• Monitor process telemetry for abnormal termination or child-process churn tied to the fluent-bit binary
• Inspect network flows to confirm that Secure Forward destinations resolve to expected, authenticated collectors only

Monitoring Recommendations

• Alert on Fluent Bit process crashes correlated with active out_forward sessions to upstream collectors
• Log and review any change to the out_forwardHost, Port, or Shared_Key configuration values
• Track DNS resolution changes for hostnames used as Secure Forward destinations to detect hijacking or impersonation attempts

How to Mitigate CVE-2026-61674

Immediate Actions Required

• Upgrade all Fluent Bit instances to version 5.0.8 or later using the official v5.0.8 release
• Audit every out_forward output configuration and confirm that upstream endpoints are trusted and reachable only over controlled network paths
• Disable the --supervisor opt-in mode until patched, since fork-only respawns weaken address-space and canary randomization
• Run Fluent Bit as an unprivileged, dedicated service account to limit impact if code execution occurs

Patch Information

The upstream fix validates the MessagePack type and length of the PONG reason field before copying it into the stack buffer. The change is included in Fluent Bit 5.0.8 and is described in the pull request discussion and the commit 45486556.

Workarounds

• Restrict egress firewall rules so Fluent Bit can only reach known, trusted Secure Forward collectors
• Terminate out_forward connections through mutually authenticated TLS to prevent server impersonation on the wire
• Temporarily disable the out_forward output plugin on hosts that cannot be patched immediately
• Ensure Fluent Bit is built and shipped with stack protection enabled and avoid running under --supervisor mode

# Verify installed Fluent Bit version and upgrade if below 5.0.8
fluent-bit --version

# Example: pull the fixed container image
docker pull fluent/fluent-bit:5.0.8

# Confirm out_forward destinations in your configuration
grep -A5 '\[OUTPUT\]' /etc/fluent-bit/fluent-bit.conf | grep -Ei 'forward|host|shared_key'