Description
Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend._substitute_params due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters to extract every agent's internal_key through a blind boolean oracle on total_affected_items.
Published: 2026-11-06
Score: 7.1 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 15:15:00 +0000

Type Values Removed Values Added
Description Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend._substitute_params due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters to extract every agent's internal_key through a blind boolean oracle on total_affected_items.
Title Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params
First Time appeared Wazuh
Wazuh wazuh
Weaknesses CWE-89
CPEs cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*
Vendors & Products Wazuh
Wazuh wazuh
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Wazuh Wazuh
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-06T15:00:47.296Z

Reserved: 2026-10-19T14:41:46.701Z

Link: CVE-2026-112341

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-06T15:17:08.710

Modified: 2026-11-06T15:17:08.710

Link: CVE-2026-112341

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')