CVE-2026-112339Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module

Beschreibung

Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wm_fluent_ssl_ctx() that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the configured ca_file. Attackers who redirect the connection via DNS, ARP, or on-path positions can receive forwarded security telemetry and the shared_key_hexdigest for offline cracking.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-v8ww-qhjh-j6w9) vendor-advisory
• wazuh v4.14.9 Release Notes release-notes
• VulnCheck Advisory: Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module third-party-advisory