---
id: "CVE-2026-112339"
page: "https://infrastack.ai/live/CVE-2026-112339"
kind: "vulnerability"
aliases: ["CVE-2026-112339"]
title: "Wazuh: missing TLS hostname check lets attackers impersonate the Fluentd collector"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["fluentd", "infrastructure", "self-hosted", "siem", "wazuh"]
not_affected_if: ["no-fluent-forward", "no-tls-to-collector", "version-4.14.9-or-later"]
published_at: "2026-11-06T15:17:08+00:00"
first_seen_at: "2026-11-06T15:42:43+00:00"
updated_at: "2026-11-06T15:44:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112339", "first_seen_at": "2026-11-06T15:42:43+00:00"}]
exploit_sources: []
---

# Wazuh: missing TLS hostname check lets attackers impersonate the Fluentd collector

Link for people: https://infrastack.ai/live/CVE-2026-112339 (this .md is for agents)

Wazuh's fluent-forward module does not verify the hostname on the certificate from the Fluentd collector it sends logs to. An attacker positioned on the network path can present any certificate signed by the configured CA, receive forwarded security telemetry, and obtain the shared key hexdigest for offline cracking.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Wazuh version with `/var/ossec/bin/wazuh-control info` or the Wazuh manager's version output; affected range is 3.9.0 up to but not including 4.14.9.
- Look for a `<fluent-forward>` or fluent-forward integration block in the Wazuh configuration that uses TLS and a `ca_file`.

## Fix

- Wazuh: move to `4.14.9` or later (the fixed version in the NVD range).

## Timeline

- 2026-11-06T15:42:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112339

## Documents

- [advisory] Vendor advisory: github.com https://github.com/wazuh/wazuh/security/advisories/GHSA-v8ww-qhjh-j6w9
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/wazuh-3.9.0-before-4.14.9-missing-tls-hostname-verification-in-fluent-forward-module
- [fix] Release notes: github.com https://github.com/wazuh/wazuh/releases/tag/v4.14.9

## From the sources

Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wm_fluent_ssl_ctx() that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the configured ca_file. Attackers who redirect the connection via DNS, ARP, or on-path positions can receive forwarded security telemetry and the shared_key_hexdigest for offline cracking.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_