CVE-2020-1887: Linuxfoundation Osquery

Critical severity, CVSS 9.1. EPSS: 1.6% chance of exploitation in the next 30 days.

Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root chain of trust.

Affected products

• Linuxfoundation Osquery: after 2.9.0, before 4.2.0 (fixed in 4.2.0)

Published 2020-03-13. Last modified 2026-06-17.