Critical · published November 24, 2025
🚨 Special characters in tag_key inputs? That’s a recipe for chaos! The Fluent Bit input plugins for in_http, in_splunk, and in_elasticsearch are leaving the door wide open for attackers. 🔥 Think of it like a restaurant accepting any strange request for a specialty dish — it might take an order for a 'Newline Burger' without a second thought, resulting in a kitchen disaster. It’s essential to check the menu before preparing the meal! An attacker can cleverly manipulate tag_key values to inject newlines or path segments, potentially leading to log misrouting or even forged records. Imagine your vital logs being misfiled or replaced, damaging data integrity and trust in your systems — absolutely devastating!
Think of it like a restaurant accepting any strange request for a specialty dish — it might take an order for a 'Newline Burger' without a second thought, resulting in a kitchen disaster. It’s essential to check the menu before preparing the meal! This vulnerability arises because the Fluent Bit input plugins fail to properly sanitize user-provided tag_key inputs, allowing attackers to input malicious characters that disrupt normal processing and routing of logs.
An attacker can cleverly manipulate tag_key values to inject newlines or path segments, potentially leading to log misrouting or even forged records. Imagine your vital logs being misfiled or replaced, damaging data integrity and trust in your systems — absolutely devastating! Immediately audit your use of Fluent Bit plugins and ensure you’re running the latest version that addresses this vulnerability. Implement strict input validation for tag_key fields to prevent exploitation. Monitoring logs for unusual behavior can also help in detecting potential misuse. You’ve got this! By taking the right steps, you can keep your data safe and your logs flowing smoothly. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| treasuredata/fluent_bit | all versions | — |