{"id":"CVE-2026-112339","published":"2026-11-06T15:17:08.377","lastModified":"2026-11-11T03:16:48.457","description":"Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wm_fluent_ssl_ctx() that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the configured ca_file. Attackers who redirect the connection via DNS, ARP, or on-path positions can receive forwarded security telemetry and the shared_key_hexdigest for offline cracking.","cvssScore":5.9,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-297"],"vendors":[],"products":[],"references":[{"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.9","tags":[]},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-v8ww-qhjh-j6w9","tags":[]},{"url":"https://www.vulncheck.com/advisories/wazuh-3.9.0-before-4.14.9-missing-tls-hostname-verification-in-fluent-forward-module","tags":[]},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-v8ww-qhjh-j6w9","tags":[]}],"exploitRefs":[{"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.9","tags":[]},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-v8ww-qhjh-j6w9","tags":[]},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-v8ww-qhjh-j6w9","tags":[]}],"hasPoc":true,"ai":null}