tag key vulnerability

The tag key vulnerability refers to CVE-2025-12977, a critical flaw in Fluent Bit's input plugins such as in_http, in_splunk, and in_elasticsearch. This vulnerability allows unauthenticated remote attackers to manipulate, reroute, and corrupt logging pipelines by supplying crafted tag values. The issue arises because Fluent Bit fails to properly sanitize values used as tag_key, accepting special characters like newlines or "../" as legitimate tags. This can lead to unauthorized access and data corruption in logging systems. Discussions on WindowsForum cover the nature of the vulnerability, its impact on logging pipelines, and potential mitigation strategies for affected systems.