CVE-2026-112339
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
66/100
Published: 2026-11-06
Modified: 2026-11-06
First seen: 2026-11-06
Status: active
Attack Surface
Network
No Auth
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
S:
X
AT:
Present
VC:
High
VI:
None
VA:
None
Description
Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wm_fluent_ssl_ctx() that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the configured ca_file. Attackers who redirect the connection via DNS, ARP, or on-path positions can receive forwarded security telemetry and the shared_key_hexdigest for offline cracking.