CVE-2026-112341

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.8

Description An issue exists in the WazuhDBBackend. substitute params() function caused by sequential regex placeholder cross-contamination. Authenticated users with agent:read permissions on a single agent can perform a SQL injection using UNION SELECT via the q and search parameters. This allows the extraction of the internal key for all agents through a blind boolean oracle on total affected items. A blind boolean oracle is a technique used to extract data by asking the database true/false questions based on the application's response.

Recommendations Update to version 4.14.9 or later.