CVE-2025-12978

published 2025-11-24 11 mo ago modified 2026-10-08 32 d ago also BIT-fluent-bit-2025-12978 , EUVD-2025-198807

cvss: 5.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits: 0; none known

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation.

Patch / fix

fixed in 2

bitnami fluent-bit 4.1.1
FluentBit Fluent Bit 4.0.12

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 11 mo ago (2025-11-24)

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CNA	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
OSV	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Affected packages

ecosystem	package	affected	fixed in
bitnami	fluent-bit	>=4.1.0, <4.1.1	4.1.1

Affected products

FluentBit Fluent Bit

References

fluentbit.io /announcements/v4.1.0/
release-notes, article
nvd.nist.gov /vuln/detail/CVE-2025-12978
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary