Wazuh CVE-2026-34150

Exploitation requires network reachability to the Wazuh manager's remoted (agent protocol, default TCP 1514) and authd (enrollment, default TCP 1515) services, plus the password-less agent enrollment that is enabled in the official wazuh/wazuh-docker default configuration - that default is the exact precondition, letting an unauthenticated attacker obtain a valid agent ID and key without credentials. The concrete trigger is a rootcheck event containing a {key: value} pattern longer than 30 bytes, which overflows the fixed 30-byte sprintf buffer in W_JSON_ParseRootcheck. What LIMITS exploitation: deployments that have replaced the default by enforcing an enrollment password (use_password) or certificate-based authd authentication, or that firewall remoted/authd to trusted agent subnets, remove the unauthenticated self-enrollment path and block the documented attack; only Wazuh manager versions 1.0.0 through 4.14.4 are affected.

The signals are internally consistent and point to a genuine, easily reachable availability risk rather than an inflated high-CVSS finding. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects unauthenticated network exploitation with low complexity and no user interaction, and the description confirms this is realistic against the default Docker configuration because authd accepts password-less enrollment out of the box. Impact is confined to availability (C:N/I:N) - no data theft or code execution is claimed - but the availability loss is severe and stealthy: alert processing stops while the API and dashboard keep showing stale data, so defenders may not notice the SIEM has gone blind. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation likelihood cannot be quantified; the absence of KEV/POC suggests it is not yet weaponized, but the low attack complexity and default-config reachability make it a high-priority patch for any manager exposed to an untrusted agent network.

An attacker who can reach a default Wazuh Docker manager enrolls with authd without a password, obtaining a valid agent ID and encryption key. Using those credentials over the Wazuh agent protocol to remoted, the attacker injects a rootcheck event whose {key: value} pattern exceeds 30 bytes, triggering the sprintf overflow that crashes wazuh-analysisd. Alert processing halts silently while the dashboard keeps showing stale data; no public exploit code is currently identified, but the steps are low-complexity and require no authentication.