BaseFortify

Publication date: 2025-11-24

Last updated on: 2025-11-28

Assigner: CERT/CC

Description

Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with network access to the Fluent Bit instance exposing the forward input to send unauthenticated data. By bypassing authentication controls, attackers can inject forged log records, flood alerting systems, or manipulate routing decisions, compromising the authenticity and integrity of ingested logs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-24

Last Modified

2025-11-28

Generated

2026-07-06

AI Q&A

2025-11-24

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12969

Affected Vendors & Products

Vendor	Product	Version / Range
treasuredata	fluent_bit	4.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability in the Fluent Bit in_forward input plugin occurs because it does not properly enforce the security.users authentication mechanism under certain configurations. This flaw allows remote attackers with network access to the Fluent Bit instance exposing the forward input to send data without authentication, effectively bypassing security controls.

Impact Analysis

An attacker exploiting this vulnerability can inject forged log records, flood alerting systems, or manipulate routing decisions. This compromises the authenticity and integrity of the logs ingested by Fluent Bit, potentially leading to incorrect monitoring, alerting failures, or misdirected log data.

Hi! I’m here to help you understand CVE-2025-12969. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70