Is CVE-2026-112341 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112341 being exploited in the wild.

How severe is CVE-2026-112341?

Medium severity, with a CVSS score of 6.5, published 6 November 2026.

Is there a fix for CVE-2026-112341?

Yes: fixed in 4.14.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112341 attacked?

It is attacked over the network.

Am I affected by CVE-2026-112341?

Check whether you run Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112341: Wazuh Manager SQL injection in WazuhDBBackend._substitute_params

CVE-2026-112341 · Severity: medium · CVSS 6.5 · Published 2026-11-06

Wazuh Manager is a security information and event management platform used to monitor and protect enterprise networks. A SQL injection vulnerability in its database query handling allows authenticated users with minimal permissions to extract secret agent authentication keys from the database, potentially compromising the security of all enrolled agents. This can be exploited remotely by any user with read access to even a single agent.

Technologies: Wazuh Manager. Vendors: Wazuh.

Quick answers

Is CVE-2026-112341 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112341 being exploited in the wild.
How severe is CVE-2026-112341?: Medium severity, with a CVSS score of 6.5, published 6 November 2026.
Which products and versions are affected?: Wazuh Manager 4.0.0 to 4.14.8.
Is there a fix for CVE-2026-112341?: Yes: fixed in 4.14.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112341 attacked?: It is attacked over the network.
Am I affected by CVE-2026-112341?: Check whether you run Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.14.9

Technical details

The WazuhDBBackend._substitute_params() function performs sequential regex replacements on SQL query strings without proper isolation, allowing an attacker to set a filter parameter (q) to reference a later placeholder name (e.g., ":search"), which causes the later parameter's value to be injected into an already-quoted string literal, breaking out and executing arbitrary SQL. An authenticated API user with agent:read on any agent can exploit this via UNION SELECT statements wrapped in a blind boolean oracle on the total_affected_items response field to extract sensitive data like internal_key values from all agents.

Affected products

Wazuh Manager 4.0.0 to 4.14.8

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.