Wazuh CVE-2026-39359

Exploitation requires network reachability to the Wazuh Manager enrollment daemon (authd, default TCP 1515) and the ability to complete agent enrollment while specifying a custom group value containing path traversal ("..") sequences - the group-selection feature of authd is the exact feature abused. Per CVSS PR:N, no authentication is required against a default configuration; however, exploitation is limited where administrators have enabled authd enrollment password authentication (use_password) or otherwise restricted network access to port 1515, in which case an attacker needs the enrollment secret or insider network position. Affected deployments are Manager versions 4.0.0-4.10.3 and 4.11.0-4.14.4; no specific user interaction is needed, and impact is limited to disclosure of files under /var/ossec/etc.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) is internally consistent with the description: exploitation is over the network against the enrollment service, requires low complexity, and needs no user interaction, with impact confined to confidentiality (high) and no integrity or availability effect. The PR:N rating assumes the enrollment interface is reachable without a pre-shared enrollment password, which is the default but is frequently hardened in production - where authd requires an agent enrollment password, realistic exploitation shifts toward authenticated/insider access, so defenders should verify their enrollment configuration. This is not KEV-listed and no POC is referenced (no EPSS or SSVC data was supplied), so it should be treated as a credible but not actively-exploited priority: the exposure of client.keys and internal certificates is severe because those secrets enable agent impersonation and potential lateral movement into the monitoring fabric, which elevates practical impact beyond a simple file read. Absence of EPSS/KEV/POC signals is a data gap, not evidence of low risk.

An attacker who can reach the Manager's enrollment port registers a rogue agent and supplies a group name containing ".." (e.g. traversing from the groups directory up into /var/ossec/etc). authd accepts the group after its wopendir() check passes, and on the next configuration sync remoted streams the referenced files back to the rogue agent, delivering client.keys, ossec.conf, and internal certificates to the attacker. No exploit code is publicly identified, but the low attack complexity and lack of required user interaction make the technique straightforward to weaponize.