CVE-2025-12977

CVE-2025-12977 is a critical vulnerability in Fluent Bit's in_http, in_splunk, and in_elasticsearch input plugins, affecting treasuredata fluent_bit. It allows attackers with network access or the ability to write records to Splunk or Elasticsearch to inject malicious tag_key values. This can lead to newline injection, path traversal, forged record injection, or log misrouting, severely impacting data integrity and log routing. With a CVSS score of 9.1 (CRITICAL) and a FAUCET Risk Score of 90/100, the vulnerability is easily exploitable over the network without authentication or user interaction, potentially leading to high impact on confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating a high level of awareness and potential for future exploitation.