Missing TLS Hostname Verification in Wazuh's Fluent-Forward Module

CVE-2026-112339

What is CVE-2026-112339?

Wazuh, in versions from 3.9.0 up to, but not including, 4.14.9, suffers from a vulnerability in the fluent-forward module. This issue arises from a lack of TLS hostname verification within the wm_fluent_ssl_ctx() function. As a result, network attackers can impersonate the Fluentd collector by presenting any certificate that is chained to the configured ca_file. Through techniques like DNS spoofing or ARP poisoning, attackers can redirect connections and potentially intercept forwarded security telemetry, compromising the integrity of security data and allowing the retrieval of sensitive information such as the shared_key_hexdigest for potential offline cracking.

References