CVE-2026-61674 – Fluent Bit

Fluent Bit version 5.0.8 fixes a critical stack-based buffer overflow in the out_forward plugin's Secure Forward handshake. CVE-2026-61674 has a CVSS score of 9.2, Critical severity. The flaw affects versions 0.11.0 through 5.0.7. The plugin copies a server-controlled reason field into a fixed 32-byte stack buffer without checking its type or length. An attacker who controls or impersonates a Secure Forward destination configured with Shared_Key or Empty_Shared_Key can send an oversized reason during the first handshake and overwrite stack control data.

The impact ranges from a crash to remote code execution as the Fluent Bit process user, and the flaw also allows elevation of privilege. Builds with stack canaries reliably terminate, but builds without them, or builds that leak memory, are exposed to code execution. When the opt-in supervisor mode is used, repeated crash probes can defeat a hardened build. Proof-of-concept code exists for this vulnerability. Upgrade all Fluent Bit deployments to version 5.0.8.