# CVE-2026-61674

RCE in Fluent Bit out_forward handshake buffer overflow

- Page: https://www.vulneraibility.com/cve/CVE-2026-61674
- CVSS: 9.2
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.72% (percentile 54.1)
- CISA SSVC: exploitation poc, automatable no, technical impact total (assessed 2026-09-21)
- Weakness: CWE-121, CWE-787, CWE-843
- Also known as: GHSA-jrp8-r9hx-gf73
- Published: 2026-09-21

## Affected versions

- fluent fluent-bit: affected >= 0.11.0 and < 5.0.8

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote code execution as the Fluent Bit process user via oversized Secure Forward PONG overflow during handshake; can cause crashes or persistent exploitation in supervisor mode.

## Action

Immediate action required

## Recommendation

Upgrade to Fluent Bit v5.0.8 immediately; restrict/trust Secure Forward endpoints and network access

## References

- [other] https://github.com/fluent/fluent-bit/security/advisories/GHSA-jrp8-r9hx-gf73
- [other] https://github.com/fluent/fluent-bit/pull/11945
- [other] https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0
- [other] https://github.com/fluent/fluent-bit/releases/tag/v5.0.8

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.