Critical Flaws in Fluent Bit Expose Cloud Infrastructure to RCE and Stealthy Intrusions

A set of five severe vulnerabilities has been discovered in **Fluent Bit**, the lightweight, open-source telemetry agent widely used across cloud and Kubernetes environments. Cybersecurity firm Oligo Security reported that these flaws can be **chained together** to completely compromise and take over cloud infrastructure.

Fluent Bit is the critical component responsible for collecting and routing logs and metrics from applications within major platforms like AWS, GCP, and Azure. Successful exploitation of these defects grants attackers the ability to not only disrupt services but also **"blind" security teams** by manipulating the very logs designed to track intrusions.

The Impact: RCE and Undetectable Intrusions

Researchers warn that the level of control enabled by these vulnerabilities allows an attacker to breach deeper into a cloud environment, execute malicious code, and critically, dictate which events are recorded. This enables them to **erase or rewrite incriminating entries** to hide their tracks after an attack, inject false telemetry, and mislead responders.

The security defects identified cover a range of attack vectors, including:

• Bypassing authentication controls.
• Achieving Remote Code Execution (RCE).
• Causing Denial-of-Service (DoS) conditions.
• Manipulating log tags and content.

Summary of Critical Vulnerabilities (CVEs)

The list of identified vulnerabilities underscores the severity of the threat:

• CVE-2025-12972 (RCE/Log Tampering): A path traversal flaw in tag value processing allows attackers to write or overwrite arbitrary files on disk, which can lead directly to Remote Code Execution and log tampering.
• CVE-2025-12970 (Buffer Overflow/RCE): A stack buffer overflow in the Docker Metrics input plugin (`in_docker`), exploitable by creating containers with excessively long names, resulting in possible code execution or agent crashes.
• CVE-2025-12978 (Authentication Bypass/Tag Spoofing): A vulnerability in the tag-matching logic allows attackers to spoof trusted log tags by guessing only the first character, enabling log rerouting, filter bypass, and the injection of malicious records under trusted tags.
• CVE-2025-12977 (Log Corruption): Improper input validation of user-controlled tags allows for the injection of newlines and control characters, which can corrupt downstream logs and confuse security tools.
• CVE-2025-12969 (Missing Authentication): A critical missing `security.users` authentication in the `in_forward` plugin allows unauthorized parties to send logs, inject false telemetry, and flood security systems with false events.

Urgent Remediation Required

The CERT Coordination Center (CERT/CC) has issued an independent advisory, confirming that many of these vulnerabilities require an attacker to have network access to a Fluent Bit instance for exploitation.