CVE-2025-15612

Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE

State: Published
Severity: 6.3 Medium
Published: Mar 27, 2026
Updated: Jul 28, 2026
Reserved: Mar 20, 2026

Description

Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation. Attackers with network access can perform man-in-the-middle attacks to intercept and modify downloaded dependencies or code during the build process, leading to remote code execution and supply chain compromise.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-295 Improper Certificate Validation
CWE-829 Inclusion of Functionality from Untrusted Control Sphere

Affected Products

Product	Versions
Wazuh Provisioning Scripts (Agent Build Environment)Wazuh	>=4.1.3Affected >=4.14.0Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.