Vulnerability · Published Mar 27, 2026 · Assigned by VulnCheck
CVE-2025-15612Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE
Medium 4.8
In plain English
A medium-severity improper certificate validation in Wazuh Provisioning Scripts (Agent Build Environment) from Wazuh. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Official description
Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation. Attackers with network access can perform man-in-the-middle attacks to intercept and modify downloaded dependencies or code during the build process, leading to remote code execution and supply chain compromise.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Wazuh | Wazuh Provisioning Scripts (Agent Build Environment) | >=4.1.3 |
Weakness: CWE-295, CWE-829 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N