Fluent Bit CVE-2026-61674

Requires a Fluent Bit instance using the out_forward output plugin in Secure Forward mode with Shared_Key or Empty_Shared_Key configured - this is not the default output path. The attacker must control the configured upstream forward destination or be able to impersonate/MITM that TCP connection so it can respond to the handshake. Reliable remote code execution additionally requires a build compiled without a stack canary, or a separate memory-disclosure primitive; builds with a stack canary reliably terminate (denial of service only). The opt-in --supervisor mode with fork-only respawns further weakens hardened builds by preserving the canary and address layout across restarts, enabling repeated crash-or-survive probing. Limiting factors: non-default Secure Forward configuration, required adversarial network position as the forward peer, and target build hardening.

The CVSS 4.0 base score of 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) reflects a network-reachable, unauthenticated stack buffer overflow with full CIA impact, but several signals temper the real-world urgency. The AT:P (Attack Requirements: Present) metric is the key qualifier the raw '9.2' obscures: exploitation is not fire-and-forget against any Fluent Bit instance - the attacker must occupy the position of the out_forward Secure Forward destination (control it or impersonate/MITM it) AND the target must be configured with Shared_Key or Empty_Shared_Key. No EPSS score, CISA KEV entry, or public exploit code is present in the provided intelligence, so this is 'no public exploit identified at time of analysis' rather than an actively exploited threat. Critically, the description itself scopes the impact: 'protected builds reliably terminate' (a canary turns RCE into a denial-of-service crash), and reliable RCE requires either a build compiled without a stack canary or a companion memory-disclosure primitive; the --supervisor fork-only mode is a secondary enabler that lets an attacker repeatedly probe a hardened build because respawns preserve the canary and ASLR layout. Net: a genuinely serious memory-corruption bug in very widely deployed software, but real-world exploitability is gated by a non-default output configuration, an adversarial network position, and target build hardening - making it a high-priority patch for anyone running out_forward with Secure Forward, and lower urgency for the majority of deployments that do not.

An attacker who controls or can impersonate (via MITM or DNS/routing hijack) the upstream server that a Fluent Bit out_forward plugin connects to in Secure Forward mode responds during the initial handshake with a PONG message whose reason field (PONG[2]) is an oversized MessagePack string. secure_forward_pong memcpy's it into a 32-byte stack buffer without type or length validation, overwriting stack control data. On a build without a stack canary (or paired with an info-leak), this yields remote code execution as the Fluent Bit process user; on hardened builds it reliably crashes the process. No public exploit code was identified in the provided intelligence.