CVE-2025-12969: Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows…

PriorityP343medium6.5CVSS 3.1

AVNACLPRNUINSUCLILAN

EPSS

0.56%

42.1th percentile

Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with network access to the Fluent Bit instance exposing the forward input to send unauthenticated data. By bypassing authentication controls, attackers can inject forged log records, flood alerting systems, or manipulate routing decisions, compromising the authenticity and integrity of ingested logs.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
fluentbit	fluent_bit	< 4.0.13	4.0.13
msrc	azl3_fluent-bit_3.1.10-2_on_azure_linux_3.0	—	—
msrc	azl3_fluent-bit_3.1.9-6_on_azure_linux_3.0	—	—
msrc	cbl2_fluent-bit_3.0.6-4_on_cbl_mariner_2.0	—	—
treasuredata	fluent_bit	—	—

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vendor_msrc6.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.