CVE-2025-15612 is a vulnerability in Wazuh provisioning scripts and Dockerfiles where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation. This improper certificate validation (CWE-295) creates an insecure transport channel during the agent build process. Attackers with network access can exploit this to perform man-in-the-middle attacks, intercepting and modifying code or dependencies downloaded during provisioning. This can result in remote code execution and compromise of the software supply chain. The vulnerability affects Wazuh Provisioning Scripts starting from version 4.1.3. No official patch or remediation guidance is provided in the available data.

The vulnerability allows attackers with network access to intercept and alter code or dependencies downloaded during the agent build process, potentially leading to remote code execution and supply chain compromise. This undermines the integrity and trustworthiness of the Wazuh agent build environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using provisioning scripts or Dockerfiles that disable SSL/TLS certificate validation with curl's -k/--insecure flag. Consider manually verifying the integrity of downloaded components or using secure transport methods that enforce certificate validation.