Path traversal in Wazuh Manager agent enrollment (CVE-2026-39359)

CVE-2026-39359 is an unauthenticated path traversal vulnerability in the Wazuh Manager's enrollment daemon (authd) and synchronization daemon (remoted). A logic flaw allows agents to supply a group name containing ".." sequences during enrollment; because the manager's directory validation resolves ".." to the parent directory (/var/ossec/etc), the malicious group passes the check and is stored in the global database. The remoted daemon subsequently uses this unvalidated value to build file paths, causing sensitive files such as client.keys, ossec.conf, and internal certificates to be exposed to the attacker via the agent configuration synchronization stream. Affected versions: - >= 4.0.0, <= 4.14.4 We recommend updating to: 4.10.4, 4.14.5. CVSS 7.5 · our assessment: this_week Vendor advisory: https://github.com/wazuh/wazuh/security/advisories/GHSA-6q95-fcwc-4h44 Details: https://vuln.today/cve/CVE-2026-39359