SECURITY researchers published details and proof-of-concept code on 23 September 2026 for CVE-2026-61674, a critical Fluent Bit buffer overflow rated 9.2 under CVSSv4. The flaw affects versions 0.11.0 up to, but not including, 5.0.8, where the `out_forward` plugin uses shared-key authentication. The article says there is no confirmed exploitation in the wild, but publicly available technical details increase the risk to exposed deployments.
The vulnerability is in the `secure_forward_pong()` function. During the secure-forward handshake, a client copies a server-supplied PONG “reason” string into a 32-byte stack buffer without checking its length or type. A malicious or compromised upstream forward server could send an approximately 1,000-byte string, overwrite stack data and potentially replace the saved return address.
The report says this could enable remote code execution as root, particularly where the supervisor process’s fork-based respawn model makes exploitation more reliable. A compromised aggregator could therefore affect multiple connected forwarding agents.
Administrators are advised to consult the Fluent Bit security advisory and upgrade to a release containing length and type checks for PONG responses. Where immediate upgrading is not possible, the article recommends enforcing TLS certificate verification for forward connections and restricting outbound traffic to trusted aggregator IP addresses.