CVE-2026-112341 | Wazuh up to 4.14.8 WazuhDBBackend WazuhDBBackend._substitute_params q/search sql injection

November 6, 2026 Yanac

A vulnerability was found in Wazuh up to 4.14.8 and classified as critical. This impacts the function WazuhDBBackend._substitute_params of the component WazuhDBBackend. The manipulation of the argument q/search results in sql injection.

This vulnerability is identified as CVE-2026-112341. The attack can be executed remotely. There is not any exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More