EUVD-2026-51833
GHSA-v7qc-fpqm-p46f
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Enrolled agent credential required (PR:L); cross-cluster poisoning depends on shared-indexer and ID collision (AC:H); scope changes to affect a foreign cluster's records (S:C); integrity-only impact, no confidentiality or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override the cluster_name and cluster_node fields in inventory-sync Start FlatBuffer messages, while validating only the agentid against the authenticated agent identity. This allows a low-privileged enrolled agent to spoof cluster attribution in indexed inventory and vulnerability documents by forging wazuh.cluster.name values and influencing the document _id prefix, potentially tampering with inventory records or, in shared-indexer multi-cluster deployments, poisoning another cluster's records when numeric agent IDs collide.
AnalysisAI
Cluster attribution spoofing in Wazuh 5.0.0-beta1 and beta2 allows an authenticated enrolled agent to forge wazuh.cluster.name and cluster_node values in inventory-sync FlatBuffer Start messages, because the server validates only the agentid against the enrolled identity while accepting arbitrary cluster metadata fields from the caller. In shared-indexer multi-cluster deployments where numeric agent IDs collide across clusters, a malicious agent can inject inventory and vulnerability documents into a foreign cluster's namespace, corrupting that cluster's security posture data. No public exploit has been identified at time of analysis; exploitation is constrained to pre-release beta deployments and requires an already-enrolled agent, substantially limiting real-world exposure.
Technical ContextAI
Wazuh 5.x introduces a FlatBuffer-serialized inventory-sync protocol that carries host inventory and vulnerability scan data from agents to an indexer backend (OpenSearch or Elasticsearch). The Start message in this protocol includes cluster_name and cluster_node metadata fields alongside the agent's numeric agentid. CWE-345 (Insufficient Verification of Data Authenticity) applies because the Wazuh manager validates the agentid against the authenticated agent's enrolled identity but accepts caller-supplied cluster_name and cluster_node values without cross-referencing them against the server's own authoritative cluster configuration. Because document _id prefixes in the indexer are derived from these cluster fields, forged values redirect indexed records to incorrect cluster namespaces. In multi-cluster deployments sharing a single indexer instance, agent ID numbering is locally scoped within each cluster but may collide numerically across clusters, enabling cross-tenant record poisoning. The affected CPE is cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:* covering versions from 5.0.0-beta1 through pre-beta3.
RemediationAI
Upgrade to Wazuh 5.0.0-beta3 or any subsequent release, which introduces server-side enforcement that overrides or rejects caller-supplied cluster_name and cluster_node fields in inventory-sync Start FlatBuffer messages, anchoring cluster attribution to the server's authoritative identity. The upstream fix is at https://github.com/wazuh/wazuh/commit/b3dae02ec9ddcfd449cb61b4c76d180e3e43f79a and the vendor security advisory is at https://github.com/wazuh/wazuh/security/advisories/GHSA-jv5p-fhwh-9w55. If immediate upgrade is not feasible for beta deployments, organizations running shared-indexer multi-cluster architectures should isolate the indexer per cluster - either via separate indexer instances or strict index-level access controls (OpenSearch fine-grained access control or Elasticsearch index privilege scoping) - which eliminates the cross-cluster poisoning vector (SI:H) but does not remediate local inventory spoofing (VI:H). Additionally, auditing and tightly controlling agent enrollment tokens reduces the pool of principals capable of sending crafted FlatBuffer messages. Note that running production workloads on pre-release beta software amplifies upgrade urgency; the stable 5.0.0 release is the preferred target.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in version
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running v
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node,
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or dele
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-pr
Arbitrary file deletion on a Wazuh manager via the cluster synchronization protocol allows a cluster-authenticated attac
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that al
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today