Description
Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with network access to the Fluent Bit instance exposing the forward input to send unauthenticated data. By bypassing authentication controls, attackers can inject forged log records, flood alerting systems, or manipulate routing decisions, compromising the authenticity and integrity of ingested logs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FluentBit | Fluent Bit | < 4.0.13 | 4.0.13 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | fluent-bit | 3.1.10-4 | — |
| Azure Linux 2 (CBL-Mariner) | fluent-bit | 3.0.6-6 | — |
Advisories 1
- WID-SEC-2025-2670 Fluent Bit: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 25, 2025