The vulnerability is introduced by the use of curl with the -k/--insecure flag in Wazuh provisioning scripts and Dockerfiles. This disables SSL/TLS certificate validation and allows attackers to perform man‑in‑the‑middle attacks during the build process. By intercepting and modifying the downloaded dependencies or code, an attacker can inject malicious code that is executed as part of the agent build, leading to remote code execution and supply‑chain compromise. The weakness is an improper verification of cryptographic signatures and unauthorized access to resources (CWE‑295, CWE‑829).

The affected components are the Wazuh Provisioning Scripts used for the agent build environment. No specific patched versions are listed in the CNA data; therefore, the impact applies to all versions that still use the insecure curl invocation. Operators should check the Wazuh repository or release notes for updates that remove the insecure flag.

The CVSS base score of 6.3 indicates a medium severity for this vulnerability. The EPSS score is reported as less than 1 %, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, the likely attack vector is a network attacker who can observe or intercept the build traffic, such as an attacker with access to the CI pipeline or the repository hosting the build artifacts. Inference: because curl is called with --insecure, any network path that supplies the dependencies can be tampered with to deliver malicious code into the build environment. Hence, the risk is contingent on network exposure of the build infrastructure.