CVE-2026-112339

Name of the Vulnerable Software and Affected Versions Wazuh versions 3.9.0 through 4.14.8

Description The fluent-forward module contains a flaw in the wm fluent ssl ctx() function due to missing TLS hostname verification. This allows a network attacker to impersonate a Fluentd collector by presenting any certificate that chains to the configured ca file. By redirecting the connection through DNS, ARP, or on-path positions, an attacker can intercept forwarded security telemetry and obtain the shared key hexdigest for offline cracking.

Recommendations Update to version 4.14.9 or later.