CVE-2026-112339

Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wm fluent ssl ctx() that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the configured ca file. Attackers who redirect the connection via DNS, ARP, or on-path positions can receive forwarded security telemetry and the shared key hexdigest for offline cracking.