Authentication Bypass Using an Alternate Path or Channel Affecting fluent/fluent-bit package, versions [,4.1.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-UNMANAGED-FLUENTFLUENTBIT-14107159
- published26 Nov 2025
- disclosed24 Nov 2025
- creditUnknown
Introduced: 24 Nov 2025
NewCVE-2025-12969 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade fluent/fluent-bit to version 4.1.1 or higher.
Overview
Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the in_forward plugin. An attacker can inject forged log records, flood alerting systems, or manipulate routing decisions by sending unauthenticated data to the exposed input.