The vulnerability resides in the wm_fluent_ssl_ctx() function of Wazuh's fluent-forward module. Because TLS hostname verification is omitted, an attacker can present any certificate chained to the configured ca_file to masquerade as the Fluentd collector. This allows the attacker to receive forwarded security telemetry and capture the shared_key_hexdigest, providing a pathway to offline cracking of authentication credentials. The weakness falls under CWE‑297, improper validation of information provided by a communication partner.

The issue affects wazuh:wazuh versions 3.9.0 through 4.14.8 inclusive. Users employing the bundled fluent-forward module in those releases are impacted. No specific operating system or platform restrictions are listed, so any environment running the affected Wazuh version is vulnerable.

The CVSS score of 8.2 indicates high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, but the lack of hostname verification makes man‑in‑the‑middle attacks straightforward for network attackers who can redirect traffic via DNS, ARP spoofing, or other on‑path techniques. Once redirected, the attacker can intercept telemetry and harvest credentials, potentially leading to a compromise of the monitoring infrastructure. Given these conditions, the risk to organizations remains substantial until the issue is addressed.