CVE-2025-12969 json
CVE-2025-12969
published 2025-11-24 11 mo ago modified 2026-10-08 31 d ago also BIT-fluent-bit-2025-12969 , EUVD-2025-198808
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with network access to the Fluent Bit instance exposing the forward input to send unauthenticated data. By bypassing authentication controls, attackers can inject forged log records, flood alerting systems, or manipulate routing decisions, compromising the authenticity and integrity of ingested logs.
Patch / fix
- bitnami fluent-bit 4.1.1
- FluentBit Fluent Bit 4.0.13
- fluent-bit CBL-Mariner 2.0 3.0.6-6
- fluent-bit Azure Linux 3.0 3.1.10-4
azure linux advisories AZL-71077AZL-71108
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 11 mo ago
Exploit prediction
0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | fluent-bit | >=4.1.0, <4.1.1 |
4.1.1 |
Affected products
- FluentBit Fluent Bit
Classification
- Weakness
-
- CWE-306 Missing Authentication for Critical Functionality
References
Sources
- CVE List CVE-2025-12969
- NVD CVE-2025-12969
- OSV BIT-fluent-bit-2025-12969
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.