CVE-2026-61674: 
Fluent Bit vulnerability analysis and mitigation

CVE-2026-61674 is a remote stack buffer overflow vulnerability in Fluent Bit's out_forward Secure-Forward PONG handler, affecting versions 0.11.0 through 5.0.7. The flaw exists in plugins/out_forward/forward.c where the secure_forward_pong() function copies a server-controlled PONG reason string into a 32-byte stack buffer via memcpy without validating the MessagePack type or length. An attacker who controls or can impersonate a configured Secure Forward destination can trigger a reliable crash (DoS) on canary-protected builds, or achieve remote code execution on builds without stack canaries. The vulnerability was published on September 8, 2026, and fixed in version 5.0.8. It carries a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory, Microsoft MSRC).

The root cause is a stack-based buffer overflow (CWE-121 / CWE-787) combined with a type confusion issue (CWE-843) in secure_forward_pong(). The function declares a 32-byte stack buffer char msg[32] and calls memcpy(msg, o.via.str.ptr, o.via.str.size) on the third element of the PONG msgpack array (PONG[2]) without checking the element's type or bounding its size — unlike PONG[0], which is properly type- and length-checked. Because the PONG is read into a 1024-byte stack buffer, a server can supply a string of up to ~1015 bytes, overwriting ~983 bytes past msg, including the saved frame pointer (at msg+40 on canary builds, msg+48 on no-canary) and return address (at msg+56). The missing type check also allows a BIN/EXT msgpack element to be used interchangeably, enabling type confusion. Exploitation requires the Fluent Bit agent to have out_forward configured with Shared_Key or Empty_Shared_Key and TLS peer verification disabled (the default), and the attacker must control or be on-path to the configured destination (GitHub Advisory, Fix Commit).

On canary-protected builds, exploitation guarantees a remote denial of service via SIGABRT, crashing the Fluent Bit process and disrupting log, metric, and trace collection. On builds compiled without stack canaries or where the canary is disclosed, an attacker achieves full remote code execution as the Fluent Bit process user — demonstrated end-to-end as uid=0(root) using a libc ROP chain. On hardened builds (stack canary + ASLR) running under the --supervisor flag, leakless RCE is achievable via Blind ROP (BROP), because the supervisor's fork()-without-execve respawn model freezes the canary and ASLR layout across crash-respawns. A single compromised or impersonated aggregator can fan out to compromise every Fluent Bit agent connecting to it on first flush, enabling fleet-wide lateral movement, credential theft, and arbitrary file system access (GitHub Advisory).

A proof-of-concept Python exploit (~130 lines) is publicly available in the GitHub Security Advisory, including mal_server_shell.py and mal_server_revsh.py demonstrating RCE and interactive reverse shell as root (GitHub Advisory). The NVD SSVC assessment classifies exploitation status as "poc" with "total" technical impact. No in-the-wild exploitation has been confirmed as of the advisory date. The EPSS score is approximately 0.0085 (0.85%), reflecting low but non-negligible exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires no authentication and no user interaction, but does require network position to control or impersonate the configured forward destination (Feedly).

1. Reconnaissance: Identify Fluent Bit deployments using out_forward with Shared_Key or Empty_Shared_Key authentication, targeting versions 0.11.0–5.0.7. Determine the configured forward destination host and port (default: 24224).
2. Position for attack: Either compromise the legitimate upstream Fluent Bit/Fluentd aggregator, or perform a network-level MITM/DNS spoofing attack to redirect the agent's forward connection to an attacker-controlled server. TLS peer verification is off by default, making MITM straightforward.
3. Set up malicious forward server: Deploy the PoC Python malicious server (from GHSA-jrp8-r9hx-gf73) listening on the target port. The server performs the Secure Forward handshake: sends a valid HELO message containing a nonce so the client's PING step succeeds.
4. Receive PING from victim: The Fluent Bit agent initiates a connection on first flush, calls secure_forward_handshake(), reads the HELO, and sends a PING with the nonce-derived authentication.
5. Send malicious PONG: The attacker's server replies with a crafted msgpack PONG array: ["PONG", false, <oversized_reason>, "h", "d"]. For DoS: reason = "A"*900. For RCE (no-canary): reason = "A"*40 + "\x00"*8 (canary placeholder) + RBP_junk (8 bytes) + ROP_chain, where the ROP chain is pop_rdi; ret; <cmd_ptr>; ret; <system_addr>.
6. Trigger buffer overflow: The victim's secure_forward_pong() calls memcpy(msg, o.via.str.ptr, o.via.str.size) with no bounds check, overflowing the 32-byte msg buffer and overwriting the saved RBP (at offset +40/+48) and return address (at offset +48/+56).
7. Achieve DoS or RCE: On canary builds, the stack canary at msg+40 is corrupted, triggering SIGABRT (rc=134). On no-canary builds, the overwritten return address redirects execution to the ROP chain, calling system() with an attacker-controlled command string, achieving RCE as the Fluent Bit process user.
8. Leakless RCE on hardened builds (--supervisor): If the target runs under --supervisor, exploit the frozen canary/ASLR across fork-respawns using BROP: probe reason[40:48] byte-by-byte (survive = correct byte, crash = wrong byte) to recover all 8 canary bytes in ≤256×7 probes. Recover gadget/system() addresses via crash classification. Inject the recovered canary + ROP chain in a final payload to achieve uid=0(root) without any memory disclosure (GitHub Advisory).

• Network: Unexpected TCP connections from Fluent Bit agents to non-standard or newly appearing forward destination IPs/ports; repeated connection resets from the forward destination (indicative of BROP crash-respawn probing under --supervisor); unusual outbound connections from the Fluent Bit host to attacker-controlled IPs (reverse shell).
• Process: Unexpected child processes spawned by the Fluent Bit process (e.g., /bin/bash, sh, curl, wget); Fluent Bit process terminating with SIGABRT (exit code 134) or SIGSEGV repeatedly; flb-out-forward thread crashing with signal in secure_forward_pong.
• Logs: Fluent Bit error log entries: failed authorization: <garbled/oversized string> from the out_forward plugin; repeated secure_forward_handshake failures or connection resets in quick succession; *** stack smashing detected ***: terminated in system logs.
• File System: Unexpected files in /tmp/ (e.g., /tmp/PWNED as written by the PoC); new cron jobs, SSH authorized keys, or scripts created by the Fluent Bit process user; web shells or backdoors if the process user has write access to web directories.
• System: Core dump files generated by the Fluent Bit process; dmesg or kernel logs showing segmentation faults from the fluent-bit process (GitHub Advisory).

Upgrade Fluent Bit to version 5.0.8 or later, which adds strict type and bounds checking to secure_forward_pong() — bounding the memcpy to sizeof(msg)-1 and validating the msgpack type before copying (v5.0.8 Release, Fix Commit). As interim mitigations: restrict network access to Secure Forward destination servers using firewall rules or network segmentation; enable TLS peer verification for forward destinations to prevent MITM-based exploitation; avoid using Empty_Shared_Key where possible. If running under --supervisor, switch to exec-based or service-manager (e.g., systemd) restarts to re-randomize the stack canary and ASLR on each restart, preventing the BROP leakless RCE path (GitHub Advisory).

The vulnerability was reported by researcher "GameZoneHacker" and published by Fluent Bit maintainer edsiper on September 8, 2026 (GitHub Advisory). Security community coverage appeared on SecurityOnline.info and was discussed on Mastodon by infosec accounts including @DailyCyberSecurity and @hugovalters, noting the critical severity and PoC availability. The NixOS security tracker opened a tracking issue (NixOS/nixpkgs#565743) for the vulnerability. Microsoft also published an advisory entry via MSRC (Microsoft MSRC). Community reaction highlighted the fleet fan-out risk — a single compromised aggregator being able to compromise all connecting agents — as a particularly concerning aspect for large-scale Fluent Bit deployments.