{"id":"CVE-2026-112339","kind":"vulnerability","aliases":["CVE-2026-112339"],"related":[],"title":"Wazuh: missing TLS hostname check lets attackers impersonate the Fluentd collector","description":"Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wm_fluent_ssl_ctx() that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the configured ca_file. Attackers who redirect the connection via DNS, ARP, or on-path positions can receive forwarded security telemetry and the shared_key_hexdigest for offline cracking.","summary":"Wazuh's fluent-forward module does not verify the hostname on the certificate from the Fluentd collector it sends logs to. An attacker positioned on the network path can present any certificate signed by the configured CA, receive forwarded security telemetry, and obtain the shared key hexdigest for offline cracking.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fluentd","infrastructure","self-hosted","siem","wazuh"],"not_affected_if":["no-fluent-forward","no-tls-to-collector","version-4.14.9-or-later"],"how_to_check":"- Check the Wazuh version with `/var/ossec/bin/wazuh-control info` or the Wazuh manager's version output; affected range is 3.9.0 up to but not including 4.14.9.\n- Look for a `<fluent-forward>` or fluent-forward integration block in the Wazuh configuration that uses TLS and a `ca_file`.","fix":"- Wazuh: move to `4.14.9` or later (the fixed version in the NVD range).","status":"open","published_at":"2026-11-06T15:17:08+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","triaged_at":"2026-11-06T15:44:11+00:00","updated_at":"2026-11-06T15:44:11+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-06T15:44:11Z","model":"claude-haiku-5-5","output":{"fix":"- Wazuh: move to `4.14.9` or later (the fixed version in the NVD range).","reach":"network","title":"Wazuh: missing TLS hostname check lets attackers impersonate the Fluentd collector","impact":"medium","summary":"Wazuh's fluent-forward module does not verify the hostname on the certificate from the Fluentd collector it sends logs to. An attacker positioned on the network path can present any certificate signed by the configured CA, receive forwarded security telemetry, and obtain the shared key hexdigest for offline cracking.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["wazuh","fluentd","siem","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads forwarded security telemetry and obtains the shared key hexdigest","analyst_note":"Confirm the fix version and the vendor advisory details at the linked GitHub advisory; the sources give only the NVD range.","how_to_check":"- Check the Wazuh version with `/var/ossec/bin/wazuh-control info` or the Wazuh manager's version output; affected range is 3.9.0 up to but not including 4.14.9.\n- Look for a `<fluent-forward>` or fluent-forward integration block in the Wazuh configuration that uses TLS and a `ca_file`.","plain_action":"","needs_analyst":true,"not_affected_if":["no-fluent-forward","version-4.14.9-or-later","no-tls-to-collector"],"who_is_affected":"Teams running Wazuh 3.9.0 through 4.14.8 that forward logs to a Fluentd collector over TLS using the fluent-forward module. Deployments without the fluent-forward integration, or on 4.14.9 and later, are not exposed. Exploitation needs a network position between Wazuh and the collector, such as DNS redirection, ARP spoofing or an on-path device.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00079,"input_tokens":4349,"output_tokens":710,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112339':14A,17A '-2026':13A,16A '3.9.0':78C '4.14.9':80C 'allow':100C 'arp':125C 'attack':7A,48B,102C,118C 'ca':62B,116C 'certif':38B,57B,111C 'chain':112C 'check':5A 'collector':11A,42B,107C 'configur':61B,115C 'connect':122C 'contain':81C 'crack':75B,143C 'ctx':98C 'cve':12A,15A 'dns':124C 'file':117C 'fluent':28B,91C,96C 'fluent-forward':27B,90C 'fluentd':10A,18B,41B,106C 'forward':29B,64B,92C,133C 'hexdigest':72B,140C 'host':22B 'hostnam':4A,35B,85C 'imperson':8A,104C 'infrastructur':19B 'key':71B,139C 'let':6A 'log':45B 'miss':2A,83C 'modul':30B,93C 'network':52B,101C 'obtain':68B 'offlin':74B,142C 'on-path':127C 'path':53B,129C 'posit':49B,130C 'present':55B,109C 'receiv':63B,132C 'redirect':120C 'secur':65B,134C 'self':21B 'self-host':20B 'send':44B 'share':70B,138C 'siem':23B 'sign':58B 'ssl':97C 'telemetri':66B,135C 'tls':3A,84C 'verif':86C 'verifi':33B 'via':123C 'vulner':87C 'wazuh':1A,24B,25B,76C 'wm':95C","nicknames":[],"mitigations":[],"who_affected":"Teams running Wazuh 3.9.0 through 4.14.8 that forward logs to a Fluentd collector over TLS using the fluent-forward module. Deployments without the fluent-forward integration, or on 4.14.9 and later, are not exposed. Exploitation needs a network position between Wazuh and the collector, such as DNS redirection, ARP spoofing or an on-path device.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fluentd","high","infrastructure","selfhosted","siem","wazuh"],"campaign_type":null,"search_a":"'-112339':14A,17A '-2026':13A,16A 'attack':7A 'check':5A 'collector':11A 'cve':12A,15A 'fluentd':10A 'hostnam':4A 'imperson':8A 'let':6A 'miss':2A 'tls':3A 'wazuh':1A","search_b":"'attack':48B 'ca':62B 'certif':38B,57B 'collector':42B 'configur':61B 'crack':75B 'fluent':28B 'fluent-forward':27B 'fluentd':18B,41B 'forward':29B,64B 'hexdigest':72B 'host':22B 'hostnam':35B 'infrastructur':19B 'key':71B 'log':45B 'modul':30B 'network':52B 'obtain':68B 'offlin':74B 'path':53B 'posit':49B 'present':55B 'receiv':63B 'secur':65B 'self':21B 'self-host':20B 'send':44B 'share':70B 'siem':23B 'sign':58B 'telemetri':66B 'verifi':33B 'wazuh':24B,25B","search_c":"'3.9.0':78C '4.14.9':80C 'allow':100C 'arp':125C 'attack':102C,118C 'ca':116C 'certif':111C 'chain':112C 'collector':107C 'configur':115C 'connect':122C 'contain':81C 'crack':143C 'ctx':98C 'dns':124C 'file':117C 'fluent':91C,96C 'fluent-forward':90C 'fluentd':106C 'forward':92C,133C 'hexdigest':140C 'hostnam':85C 'imperson':104C 'key':139C 'miss':83C 'modul':93C 'network':101C 'offlin':142C 'on-path':127C 'path':129C 'posit':130C 'present':109C 'receiv':132C 'redirect':120C 'secur':134C 'share':138C 'ssl':97C 'telemetri':135C 'tls':84C 'verif':86C 'via':123C 'vulner':87C 'wazuh':76C 'wm':95C","first_public_at":"2026-11-06T10:28:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112339","severity":null,"published_at":"2026-11-06T15:17:08+00:00","modified_at":"2026-11-06T15:17:08+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","fetched_at":"2026-11-06T15:42:43+00:00","note":null}],"documents":[{"id":87519,"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.9","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":87537,"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-v8ww-qhjh-j6w9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T10:28:53+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":87538,"url":"https://www.vulncheck.com/advisories/wazuh-3.9.0-before-4.14.9-missing-tls-hostname-verification-in-fluent-forward-module","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}