This flaw exists in the WazuhDBBackend._substitute_params method, allowing a crafted query to bypass safe parameter handling. By injecting a UNION SELECT into the q or search parameters, a privileged user can retrieve sensitive values. The vulnerability leverages regex placeholder cross‑contamination, a classic SQL injection scenario.

All Wazuh installations running versions 4.0.0 up to but not including 4.14.9. The product is Wazuh, a security monitoring platform. The vulnerability affects the backend database interface used by authenticated agents.

CVSS 7.1 indicates moderate severity. EPSS is not available, so the probability of exploitation is uncertain, and the issue is not listed in CISA KEV. The likely attack vector requires an authenticated user with agent:read permissions, meaning an insider or compromised account can perform the attack. The use of a blind boolean oracle allows the attacker to confirm the success of the injected query and extract every agent's internal_key.