CVE-2026-112341

MediumCVSS 6.5/10Last modified Nov 9, 2026

Description

Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend._substitute_params due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters to extract every agent's internal_key through a blind boolean oracle on total_affected_items.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
wazuh	wazuh	>= 4.0.0, < 4.14.9

References

Timeline

Published: Nov 6, 2026
Last modified: Nov 9, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1123427.1Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users t CVE-2026-1123438.1Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permis CVE-2026-1123446.8Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user CVE-2026-1123458.1TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allow CVE-2026-1123469.8OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and App CVE-2026-1123477.6Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-CVE-2026-1123486.5Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend f CVE-2026-112358.8Insufficient policy enforcement in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the ren CVE-2026-1123507.5Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote a CVE-2026-1123518.8Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated r CVE-2026-1123529.8Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate CVE-2026-1123538.2GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that al