CVE-2026-112339 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Wazuh's fluent-forward module does not verify the hostname on the certificate from the Fluentd collector it sends logs to. An attacker positioned on the network path can present any certificate signed by the configured CA, receive forwarded security telemetry, and obtain the shared key hexdigest for offline cracking.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Wazuh 3.9.0 through 4.14.8 that forward logs to a Fluentd collector over TLS using the fluent-forward module. Deployments without the fluent-forward integration, or on 4.14.9 and later, are not exposed. Exploitation needs a network position between Wazuh and the collector, such as DNS redirection, ARP spoofing or an on-path device.
Not affected if no-fluent-forward, no-tls-to-collector, version-4.14.9-or-later
Who cares fluentd, self-hosted, siem, wazuh
/var/ossec/bin/wazuh-control info or the Wazuh manager's version output; affected range is 3.9.0 up to but not including 4.14.9.<fluent-forward> or fluent-forward integration block in the Wazuh configuration that uses TLS and a ca_file.4.14.9 or later (the fixed version in the NVD range).Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wm_fluent_ssl_ctx() that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the configured ca_file. Attackers who redirect the connection via DNS, ARP, or on-path positions can receive forwarded security telemetry and the shared_key_hexdigest for offline cracking.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.