Vulnerability in Wazuh
CVE-2026-112339
Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wm_fluent_ssl_ctx() that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the configured ca_file. Attackers who redirect the connection via DNS, ARP, or on-path positions can receive forwarded security telemetry and the shared_key_hexdigest for offline cracking.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- wazuh v4.14.9 Release Notes (release-notes)
- GitHub Security Advisory (GHSA-v8ww-qhjh-j6w9) (vendor-advisory)
- VulnCheck Advisory: Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module (third-party-advisory)
Frequently asked questions
- What is CVE-2026-112339?
- CVE-2026-112339 is a medium-severity vulnerability in Wazuh, classified under Improper Validation of Certificate with Host Mismatch. CVSS score: 5.9/10. Published 2026-11-06.
- How severe is CVE-2026-112339?
- Medium severity. CVSS v3 base score is 5.9 out of 10.