FluentBit 4.1.0 in_http/in_splunk/in_elasticsearch redirect

Summaryinfo

A vulnerability was found in FluentBit 4.1.0. It has been classified as critical. Affected is an unknown function of the component in_http/in_splunk/in_elasticsearch. Performing a manipulation results in redirect. This vulnerability is reported as CVE-2025-12978. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in FluentBit 4.1.0. This affects an unknown code block of the component in_http/in_splunk/in_elasticsearch. The manipulation with an unknown input leads to a redirect vulnerability. CWE is classifying the issue as CWE-698. The web application sends a redirect to another location, but instead of exiting, it executes additional code. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation.

It is possible to read the advisory at fluentbit.io. This vulnerability is uniquely identified as CVE-2025-12978 since 11/10/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/22/2025). The attack technique deployed by this issue is T1204.001 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-198807). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• FluentBit

Version

• 4.1.0

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion