Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module
Affects Wazuh 3.9.0 before 4.14.9 when the fluent-forward module uses a CA file (ca_file) or a Fluent shared key, since the shared key turns on TLS implicitly. The affected range is fixed in 4.14.9.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 4.14.9
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 4.14.9.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 25/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Wazuh's fluent-forward module does not verify the hostname of the Fluentd collector it connects to over TLS, so any certificate issued by the configured CA is accepted. A network attacker who can redirect the connection can capture forwarded security telemetry and the shared key hexdigest, which can then be cracked offline, without logging in.
Read the original description
Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wm_fluent_ssl_ctx() that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the configured ca_file. Attackers who redirect the connection via DNS, ARP, or on-path positions can receive forwarded security telemetry and the shared_key_hexdigest for offline cracking.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure17/25No login or user action needed, reachable over the network without a login · Unknown: Advisories don't say whether default setups are affected
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.2/10CVSS 8.2
- No patch0/5No signal
What would change the score
- Would score about 70 if added to CISA KEV
- Would score about 65 if CISA's SSVC rates exploitation active
- Would score about 30 if advisories confirm default setups are exposed
What to do
Upgrade to a fixed version: 4.14.9.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- wazuh wazuh
From 3.9.0 · fixed in 4.14.9
Evidence 3
- Advisory
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-112339
Is CVE-2026-112339 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The fluent-forward module does not check that the server certificate matches the host it connects to. An attacker who redirects the connection and presents a certificate issued by the configured CA could impersonate the Fluentd collector, receive forwarded security telemetry, and obtain the shared_key_hexdigest for offline cracking.Source: github.com, vulncheck.com
Which versions are affected by CVE-2026-112339?
wazuh: from 3.9.0 before 4.14.9.Source: cve.now feed data
Am I affected, and how do I check?
Wazuh 3.9.0 up to, but not including, 4.14.9. The fluent-forward module is in the affected path when it is configured with a CA file (ca_file) for TLS verification, or when a Fluent shared key is set, because that turns on TLS without the operator asking for it. To check, look at the Wazuh version and the fluent-forward settings for ca_file and shared_key.Source: github.com, vulncheck.com
How do I fix CVE-2026-112339?
Upgrade Wazuh to 4.14.9 or later, which is the first version outside the affected range.Source: github.com, vulncheck.com