Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special characters such as newlines or ../ that are treated as valid tags. Because tags influence routing and some outputs derive filenames or contents from tags, this can allow newline injection, path traversal, forged record injection, or log misrouting, impacting data integrity and log routing.
An attacker can supply crafted tag_key values containing special characters — in particular newline characters (newline injection) or path traversal sequences (../) — over the network or by writing records to Splunk or Elasticsearch. Because tags control event routing, and some outputs derive file names or content based on tags, a maliciously constructed tag can lead to file writes in unexpected locations, record forgery, or incorrect log routing. Lack of input validation (CWE-1287) means that unsafe data is treated as valid tags and processed without restrictions.
An attacker can cause path traversal (potential file writes outside the intended directory), injection of false records into the logging system, incorrect log routing, and violation of the integrity of data recorded by Fluent Bit.
Fluent Bit should be updated to version v4.1 or backported patches should be applied for the v4.0 branch according to the vendor's security advisory available at: https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/
Fluent Bit with active input plugins in_http, in_splunk, or in_elasticsearch; versions prior to v4.1 and v4.0 before applying backported patches (according to vendor references)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NTreasuredata Fluent Bit
APPTreasuredata4.1.0
Related vulnerabilities
Krytyczna podatność memory corruption w Fluent Bit — RCE i ujawnienie danych
Double free w Fluent Bit — błąd w funkcji flb_free parsera JSON
The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack ...
An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on a...
An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and list...