The vulnerability arises when curl is invoked with the -k/--insecure flag, which disables SSL/TLS certificate validation in provisioning scripts and Dockerfiles. This allows an attacker who can intercept network traffic to perform a man‑in‑the‑middle attack, modifying dependencies or code downloaded during the build process. The attacker can then inject malicious payloads that execute within the build environment, leading to remote code execution and supply chain compromise.

Wazuh provisioning scripts and Dockerfiles used in the Agent Build Environment are affected. No specific version information is available; the issue exists whenever the insecure curl usage is present.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is not available, but the requirement of network access to intercept traffic suggests a moderate likelihood of exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, yet it allows an attacker to tamper with the build code, potentially compromising any deployed agents. The overall risk is moderate to high depending on the exposure of the build infrastructure to external networks.