Medium severity6.5NVD Advisory· Published Nov 6, 2026

CVE-2026-112341

Description

Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend._substitute_params due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters to extract every agent's internal_key through a blind boolean oracle on total_affected_items.

Affected products

Wazuh/Wazuhllm-fuzzy
Range: <4.14.9

Patches

Vulnerability mechanics

References

github.com/wazuh/wazuh/releases/tag/v4.14.9nvd
github.com/wazuh/wazuh/security/advisories/GHSA-qj88-7rr2-4chxnvd
www.vulncheck.com/advisories/wazuh-before-4.14.9-sql-injection-via-wazuhdbbackend-substitute-paramsnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000