CVE-2026-61674 in Bit
Summary
by MITRE • 09/21/2026
Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/out_forward/forward.c secure_forward_pong copies the server-controlled PONG[2] reason into the 32-byte stack buffer msg with memcpy without checking its MessagePack type or length. An attacker who controls or can impersonate an out_forward Secure Forward destination configured with Shared_Key or Empty_Shared_Key can send an oversized reason during the first handshake and overwrite stack control data. Protected builds reliably terminate, while builds without a stack canary or with a disclosure can allow remote code execution as the Fluent Bit process user. When the opt-in --supervisor mode is used, fork-only respawns preserve the canary and address layout, allowing repeated crash-or-survive probes to support code execution on a hardened build; ordinary exec-based or service-manager restarts do not preserve that state. This issue is fixed in version 5.0.8.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/21/2026
Fluent Bit serves as a high-performance log processor designed for collecting, filtering, and routing data across various operating systems including Linux, BSD, macOS, and Windows. Within the architecture of Fluent Bit, the out_forward plugin facilitates communication with remote destinations using protocols such as Secure Forward. A critical vulnerability exists in versions ranging from 0.11.0 through 5.0.8 within the secure forward handshake mechanism. Specifically, the function responsible for handling the server's response during authentication contains a severe memory safety flaw that allows an attacker to compromise the integrity of the application process.
The technical root cause lies in the implementation of the secure_forward_pong handler located in plugins/out_forward/forward.c. During the initial handshake phase when using Shared_Key or Empty_Shared_Key configurations, the server sends a PONG message containing a reason string. The vulnerable code path utilizes memcpy to copy this server-controlled data directly into a fixed-size 32-byte stack buffer named msg. Crucially, the implementation fails to validate either the MessagePack type of the incoming field or its length before performing the memory operation. This lack of bounds checking means that if an attacker controls the destination server or can impersonate one via man-in-the-middle techniques, they can transmit a reason string exceeding thirty-two bytes.
This unchecked copy results in a stack-based buffer overflow. When the oversized data is written to the msg buffer, it overwrites adjacent memory on the call stack, including critical control data such as return addresses and frame pointers. In standard builds lacking protective measures like stack canaries or Address Space Layout Randomization (ASLR), this corruption allows for remote code execution with the privileges of the Fluent Bit process user. The attacker gains full control over the instruction pointer by manipulating the overwritten return address, enabling arbitrary command execution on the host system.
Even in environments where mitigations such as stack canaries are enabled, which typically cause the application to terminate upon detecting stack corruption, the vulnerability remains exploitable under specific conditions. When Fluent Bit is run with the opt-in supervisor mode using fork-only respawning strategies, the process retains its memory layout and security state across restarts. This persistence allows an attacker to perform repeated crash-or-survive probes. By iteratively sending crafted payloads that trigger controlled crashes or successful overwrites based on probabilistic outcomes of ASLR bypasses, an attacker can eventually achieve code execution even against hardened builds. In contrast, ordinary exec-based restarts or service manager interventions do not preserve this state, making exploitation more difficult but still possible in less protected environments.
From a classification perspective, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write on Stack. In the context of the MITRE ATT&CK framework, it relates to Tactic TA0004 Privilege Escalation and Technique T1068 Exploitation for Privilege Escalation, as well as initial access vectors involving remote code execution through network services. The impact is severe due to the potential for full system compromise of logging infrastructure components that often run with elevated privileges or have broad file system access.
To mitigate this risk, organizations running Fluent Bit must upgrade immediately to version 5.0.8 or later where the input validation and length checks are properly implemented. For environments unable to patch instantly, restricting network access to only trusted forward destinations can reduce exposure. Additionally, disabling Shared_Key authentication if not strictly required may eliminate the attack vector associated with this specific handshake flaw. Monitoring for unusual process termination patterns in supervisor modes could also aid in detecting active exploitation attempts targeting older vulnerable versions.