CVE-2026-112339: Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module

Published Nov 6, 2026

Updated

Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wmfluentsslctx() that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the configured cafile. Attackers who redirect the connection via DNS, ARP, or on-path positions can receive forwarded security telemetry and the sharedkeyhexdigest for offline cracking.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Wazuh to a version that resolves this vulnerability.
Fixed in 4.14.9

Event History

Nov 6, 2026

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments running Wazuh versions from 3.9.0 before 4.14.9 that use the fluent-forward module with TLS and a configured ca_file are exposed. The issue affects verification of the collector hostname, not whether the presented certificate chains to that CA file.

What must an attacker be able to do to exploit this?

An attacker needs a network position that lets them redirect the Wazuh connection to a malicious endpoint, such as through DNS or ARP manipulation or an on-path position. They must present a certificate that chains to the configured ca_file; it does not need to match the intended Fluentd collector hostname.

What could an attacker obtain through exploitation?

A successful impersonation can cause Wazuh to forward security telemetry to the attacker-controlled collector. The attacker can also receive the shared_key_hexdigest, which may be subject to offline cracking.

How can this be remediated?

Upgrade to Wazuh 4.14.9 or later. The affected range is 3.9.0 before 4.14.9.

CVE-2026-112339: Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What must an attacker be able to do to exploit this?

What could an attacker obtain through exploitation?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What must an attacker be able to do to exploit this?

What could an attacker obtain through exploitation?

How can this be remediated?