CTI not up to date for CVE-2026-33210

[app...@proton.me]

Hallo Everyone,

in the CTI.wazuh.com  CVE-2026-33210 for RH 8-10 is marked as effected:

shown her for RH 9

https://cti.wazuh.com/vulnerabilities/cves/CVE-2026-33210?affected%5Bpage%5D=1&affected%5Bvendor%5D=Red+Hat&affected%5Bplatform%5D=RHEL+9

but RedHat isnt Effected shown here:

https://access.redhat.com/security/cve/cve-2026-33210

how to fix this false positive?

with best regards

[Isaiah Daboh]

Hello,

Please note that I am taking a look at this. I will revert as soon as possible.

Regards,

[Isaiah Daboh]

Hello,

There is a known issue with this CVE that has to do with libraries for Ruby. This CVE will be sanitized manually and I will provide with you with update once the link to the issue is created and the issue is fixed.

In the meantime, you can suppress the alert from this CVE by following the step below:

- Determine the rule.id of the VD alerts.

- Add a custom rule in /var/ossec/etc/rules/local_rules.xml

<group name="vulnerability_scan_exclusion">
   <rule id="100400" level="0">
   <if_sid>23505</if_sid>
   <field name="data.vulnerability.cve">CVE-2026-33210</field>
   <description> Suppress known false positive </description> </rule>
</group>

Note: This only suppresses the alert, the vulnerability will still show up in the Vulnerability Detection inventory dashboard because that's populated directly from the indexer state, not from rule output.

Regards,