Critical FluentBit Vulnerabilities Let Attackers to Cloud Environments Remotely

Security researchers (Oligo Security with AWS coordination) disclosed five critical Fluent Bit vulnerabilities (including CVE-2025-12972, CVE-2025-12970, CVE-2025-12978, CVE-2025-12977, CVE-2025-12969) impacting input/output plugins that can enable path traversal and arbitrary file writes, remote code execution, authentication bypass, tag spoofing, and denial-of-service across widely deployed containerized/cloud environments; fixes were released in versions 4.1.1 and 4.0.12 and operators are advised to upgrade immediately and apply configuration hardening (explicit Path/File, static tags, non-root operation, read-only configs).