CVE-2026-112341: Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params

Published Nov 6, 2026

Updated

Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend.substituteparams due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters to extract every agent's internalkey through a blind boolean oracle on totalaffecteditems.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Wazuh to a version that resolves this vulnerability.
Fixed in 4.14.9

Event History

Nov 6, 2026

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An authenticated user needs agent:read permission on at least one agent. That limited access can be used to target data associated with other agents.

What information can an attacker obtain?

An attacker can use injected UNION SELECT statements through the q and search parameters to extract every agent's internal_key. Extraction is performed through a blind boolean oracle based on total_affected_items.

Which deployments are affected?

Wazuh versions from 4.0.0 through versions before 4.14.9 are affected. Version 4.14.9 is identified as the fixed release.