{"id":"CVE-2026-112339","title":"Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module","summary":"Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wm_fluent_ssl_ctx() that allows network attackers to impersonate the Fluentd collector by presenting any certificate…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-297"],"vendor":"wazuh","product":"wazuh","affected":["wazuh >= 3.9.0 < 4.14.9"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:00:45.884Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112339","references":[{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-v8ww-qhjh-j6w9","label":"GitHub Security Advisory (GHSA-v8ww-qhjh-j6w9)"},{"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.9","label":"wazuh v4.14.9 Release Notes"},{"url":"https://www.vulncheck.com/advisories/wazuh-3.9.0-before-4.14.9-missing-tls-hostname-verification-in-fluent-forward-module","label":"VulnCheck Advisory: Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T15:54:04.084Z","epss":0.00169,"epssPercentile":0.0631,"slug":"CVE-2026-112339","body":"## Overview\n\nWazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wm_fluent_ssl_ctx() that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the configured ca_file. Attackers who redirect the connection via DNS, ARP, or on-path positions can receive forwarded security telemetry and the shared_key_hexdigest for offline cracking.\n\n## Affected\n\n- `wazuh >= 3.9.0 < 4.14.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}