CRITICAL: Fluent Bit Flaws Enable RCE and Telemetry Tampering in Major Orgs

Oligo Security researchers have identified critical vulnerabilities in Fluent Bit, a telemetry agent used by major organizations. These vulnerabilities allow attackers to manipulate log routing, write malicious files, and achieve Remote Code Execution (RCE). Key vulnerabilities include: 1) Authentication Bypass (CVE-2025-12969) - allows unauthorized access if not properly configured. 2) Tag Key Spoofing (CVE-2025-12978) - enables attackers to control log data tags.

3) Tag Injection (CVE-2025-12977) - allows injection of harmful characters into tags. 4) Path Traversal File Write (CVE-2025-12972) - permits attackers to overwrite files and execute code. 5) Stack Buffer Overflow (CVE-2025-12970) - can crash the agent or execute arbitrary code. Users are urged to update to the latest version, limit dynamic tags, lock down outputs, and run Fluent Bit with least privilege.