Wazuh
Monthly
Cleartext cluster key disclosure in Wazuh 4.14.0-4.14.6 allows any low-privilege API user with the default readonly or cluster_readonly role to retrieve the shared secret that authenticates and encrypts all inter-node cluster traffic. The GET /cluster/local/config endpoint was missing the mask_sensitive_config decorator applied to every sibling config endpoint, causing the cluster.key field to be returned unredacted to accounts that are explicitly denied update-config permission. The severity of this information disclosure is amplified by prior Wazuh advisories that establish cluster-peer remote code execution chains contingent on possessing the cluster key, making this a practical stepping stone to full cluster compromise. No public exploit has been identified at time of analysis and the vulnerability is not in the CISA KEV catalog.
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running versions 4.4.0 through 4.14.6. A peer that possesses the shared cluster key can abuse the file-synchronization routine to drop, overwrite, or delete files at attacker-chosen paths under /var/ossec - including scripts executed as root - because the worker's non-merged sync branch never verifies that a synced file matches the directory declared by its cluster_item_key. This is an incomplete fix for CVE-2026-30893, and no public exploit has been identified at time of analysis; it is fixed in 4.14.7.
Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuitively makes hardened accounts more exposed than default ones. Any authenticated low-privilege user whose role includes an explicit DENY on config-update actions can issue a single GET request to the manager configuration API with `raw=true` and receive the full `ossec.conf` XML with `cluster.key` in cleartext - because the broken gate treats the mere presence of a deny-rule entry as proof of update permission, disabling masking entirely. No public exploit has been identified at time of analysis, but the fix is available in 4.14.7 and the root cause is confirmed by vendor advisory and merged commit.
NULL pointer dereference in Wazuh agent enrollment (versions 4.0.0-4.14.6) allows a network-positioned attacker operating a rogue manager or performing a man-in-the-middle attack to deterministically crash the agent process by supplying a malformed key response containing fewer than four space-separated fields. The flaw resides in `w_enrollment_process_agent_key()` in `src/shared/enrollment_op.c`, which passes unvalidated NULL entries from `OS_StrBreak()` directly into `OS_IsValidName()`, where an unguarded `strlen()` call on a NULL pointer terminates the agent. The attack is constrained by high complexity conditions (no CA certificate configured, or active MITM capability), and no public exploit code or CISA KEV listing has been identified at time of analysis. The issue is fixed in Wazuh 4.14.7.
Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who controls a monitored log source to inject arbitrary arguments into firewall and account-management commands executing as root. Five scripts handling the srcip alert field (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP format validation, and disable-account.c passes the dstuser field to passwd/chuser with only a root-name check, enabling injection into pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess concatenation in wpopenv() amplifies the impact by allowing space-delimited srcip values to append additional process arguments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or delete arbitrary files as root by injecting directory traversal sequences into the srcip field of alert-triggering log events. Versions prior to 4.14.7 are affected when ip-customblock is configured as an active response - the block action creates an empty file at an attacker-controlled path, while the unblock action deletes it, both executing as root and enabling destruction of credentials, configuration, or other critical files. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the missing validation is trivially observable by comparing ip-customblock.c against its sibling scripts.
SQL injection in Wazuh's File Integrity Monitoring subsystem allows a local low-privileged user on non-Windows systems to manipulate the FIM SQLite database by creating a specially crafted filename in any monitored directory. The `wazuh-syscheckd` daemon in versions 4.6.0 through 4.14.5 concatenates unsanitized file paths directly into SQLite row filter predicates in `DB::getFile()` and `DB::searchFile()`, enabling UNION SELECT injection when the path is processed. No public exploit or KEV listing exists; however, the vendor-merged PR test suite contains a working injection payload, and the impact - falsification or suppression of FIM integrity alerts - directly undermines the product's core security monitoring function.
Log injection in Wazuh's REST API (versions 4.4.0 through pre-4.14.6 and 5.0.0-beta1 through pre-5.0.0-beta2) allows an unauthenticated remote attacker to corrupt plain-text audit log integrity by embedding carriage return or line feed characters in the Basic authentication username field. Because the API middleware decodes the username before credential validation and passes the raw value to the access logger without control-character neutralization, the attacker can forge log entries, suppress evidence of prior activity, or poison upstream log aggregation pipelines. No public exploit has been identified at time of analysis, and the JSON log format is unaffected; the vendor-released patch is available in 4.14.6 and 5.0.0-beta2.
Stack-based buffer overflow in Wazuh's wazuh-authd enrollment daemon (versions 4.5.0 through 4.14.5 and 5.0.0-beta1) allows unauthenticated remote attackers to crash the service by sending a crafted nine-byte version string in the enrollment 'V:' field, triggering unsafe stack memory reads and a null byte write into adjacent stack frames. The vulnerable code path in compare_wazuh_versions() is reachable before authentication over TCP port 1515 when anonymous TLS enrollment is enabled, resulting in a denial of service against the agent enrollment service. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; vendor-released patches are available in versions 4.14.6 and 5.0.0-beta2.
Path-traversal-driven remote code execution in Wazuh 4.3.0 through 4.14.5 (and 5.0.0-beta1/beta2) lets a cluster peer that holds the shared Fernet key overwrite security-sensitive files on the master node. Because the non-merged branch of process_files_from_worker() in master.py trusts the peer-supplied file_path from files_metadata.json without confining it under the directory implied by cluster_item_key, an attacker can replace /var/ossec/etc/ossec.conf to configure root-executed commands and gain code execution on the next service reload. No public exploit identified at time of analysis, but a vendor fix and the fixing commit are public, making the root cause easy to study.
Privilege escalation in Wazuh 4.9.0-4.10.3 and 4.11.0-4.14.5 allows any authenticated user holding the users_admin role to overwrite the password of protected built-in administrator accounts - including the wazuh superuser - via a logic flaw in the PUT /security/users/{user_id} REST API endpoint. The API controller passes request.get("user"), which resolves to None because that key is absent from the request object, instead of extracting the authenticated principal from the JWT token; remove_nones_to_dict() then silently strips the None before it reaches the reserved-account authorization guard in the framework layer, causing the protection check to fail open. The issue is confirmed fixed in v4.10.4 and v4.14.6; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file deletion on a Wazuh manager via the cluster synchronization protocol allows a cluster-authenticated attacker to destroy critical files including ossec.conf, jwt_secret.json, and TLS certificates, effectively disabling the manager or invalidating all API authentication tokens. The flaw spans Wazuh 4.0.0 through 4.14.5 and the 5.0.0-beta2 pre-release, rooted in missing path canonicalization inside the cluster file-receive cleanup handler. No public exploit or active exploitation has been identified at time of analysis; however, CVSS 4.0 rates the vulnerable-system impact as High across confidentiality, integrity, and availability, making this a high-priority patch for any clustered Wazuh deployment.
Stack out-of-bounds write in Wazuh's root-level remoted daemon allows an authenticated agent to crash manager message processing by sending a specially crafted compressed payload over TCP port 1514. Versions 1.0.0 through 4.14.5 (stable) and 5.0.0-beta1 are affected; the decompression function writes a null terminator one byte beyond the stack buffer boundary when the message expands to exactly OS_MAXSTR bytes, corrupting the daemon stack and disrupting all agent communications. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; fixed versions 4.14.6 and 5.0.0-beta2 are available.
Memory exhaustion in Wazuh's cluster protocol allows an authenticated cluster node to crash the master by sending unbounded allocation requests via the new_str command or the divided-message reassembly path. Affected deployments span versions 3.9.0 through 4.14.4 and 5.0.0-beta1, with the primary operational impact being disruption of agent connectivity and alert processing across the monitored environment. No public exploit has been identified at time of analysis; however, the published patch diff fully exposes both vulnerable code paths, lowering the barrier for future exploit development.
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-privilege API user with manager:read permission can retrieve the plaintext Fernet cluster key via the raw configuration endpoint, then use it to impersonate a cluster worker node and inject attacker-controlled RBAC permissions that grant full administrative access. The master node's unconditional trust in worker-supplied authorization context (CWE-863 - Incorrect Authorization) allows an attacker to create admin users, access stored credentials and API tokens, modify platform configuration, and execute arbitrary commands across all Wazuh-managed agents. No public exploit has been identified at time of analysis; the vendor-released fix is confirmed in version 4.14.5.
Username enumeration via observable timing discrepancy in Wazuh's authentication layer exposes valid account names to unauthenticated remote attackers across all 4.x deployments from 4.0.0 and the 5.0.0-beta1 pre-release. The root cause is an asymmetric code path in AuthenticationManager.check_user() - nonexistent usernames return immediately while valid usernames trigger an expensive bcrypt hash computation, creating a reliably measurable latency gap of roughly 100-300 ms versus sub-millisecond response. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive reliably enables targeted credential-stuffing or brute-force follow-on attacks.
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in versions 4.0.0 through 4.14.5 and the 5.0.0-beta line up to 5.0.0-beta3. A malicious or compromised cluster peer that possesses the shared Fernet key can smuggle directory-traversal sequences through merge_type/name values or a merged-file header, causing the master node to write attacker-controlled files (e.g. /var/ossec/etc/ossec.conf) outside the intended cluster item directory; overwriting ossec.conf lets the attacker define root-executed commands that fire when Wazuh services reload. No public exploit has been identified at time of analysis, and the issue is not in CISA KEV; the vendor fix landed in 4.14.6 and 5.0.0-beta3.
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that already holds the shared cluster Fernet key coerce the master into returning any file it can read over the encrypted cluster channel. By retrieving /var/ossec/api/configuration/security/private_key.pem, that peer can forge administrator REST API tokens offline and exercise full administrative privileges without ever creating an account. No public exploit identified at time of analysis; the underlying fix is confirmed in the vendor advisory and shipped in 4.14.6 and 5.0.0-beta3.
Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node, exploiting unsafe Python builtin resolution in the distributed API merge path. Affected versions span 4.0.0 through 4.14.5 and 5.0.0-beta1; the vulnerable code in framework/wazuh/core/results.py called getattr(builtins, type_) with attacker-supplied strings from worker JSON responses, enabling exec or eval injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is mechanically trivial once a worker node is controlled, with the payload executing as root on the master.
Memory exhaustion in Wazuh Manager 4.4.0 through 4.14.6 allows authenticated cluster peers to crash the wazuh-clusterd daemon on the master node by submitting a specially crafted zip bomb archive during cluster synchronization. The fdecompress_files() function in cluster.py invoked zlib.decompress() without any decompressed-size limit, enabling an attacker holding a valid cluster Fernet key to force unbounded memory allocation from a tiny compressed payload. No public exploit has been identified and the vulnerability is absent from CISA KEV; Wazuh has released a fix in version 4.14.7 via GitHub pull request #37119.
Path traversal via unsanitized cluster node names in Wazuh Manager 4.0.0 through 4.14.5 enables authenticated cluster peers to delete arbitrary directory contents on the master node. An attacker holding a valid cluster Fernet key can supply a traversal-shaped node name (e.g., '../../etc') in the cluster hello handshake, then disconnect - causing the master's peer cleanup routine to recursively remove the contents of directories outside the intended cluster queue path, writable by the wazuh user. No public exploit has been identified at time of analysis, and a vendor patch is available in 4.14.6.
CPU exhaustion in Wazuh Manager 4.0.0-4.14.6 and 5.0.0-beta2 allows authenticated API users with the allow_run_as permission to fully deny service to all other API consumers by submitting arbitrarily deeply nested JSON to the POST /security/user/authenticate/run_as endpoint. The API framework processes these structures recursively without any depth or size limit, consuming CPU proportionally to nesting depth until the process becomes unresponsive. No public exploit identified at time of analysis, though the attack primitive is trivially constructible from the CVE description alone.
Path traversal in Wazuh Manager 4.0.0 through 4.14.5 allows unauthenticated remote attackers to destroy the manager's queue directory structure and halt all Wazuh services by registering an agent whose name begins with a dot (e.g., ".."). Two compounding weaknesses drive the impact: OS_IsValidName() failed to reject dot-prefixed agent names, and delete_diff() performs unsafe path concatenation that resolves the traversal sequence to the parent queue directory, wiping its subdirectories. Recovery requires manual intervention, creating a complete and sustained loss of SIEM and XDR visibility. No public exploit or CISA KEV listing has been identified at time of analysis.
Cluster attribution spoofing in Wazuh 5.0.0-beta1 and beta2 allows an authenticated enrolled agent to forge wazuh.cluster.name and cluster_node values in inventory-sync FlatBuffer Start messages, because the server validates only the agentid against the enrolled identity while accepting arbitrary cluster metadata fields from the caller. In shared-indexer multi-cluster deployments where numeric agent IDs collide across clusters, a malicious agent can inject inventory and vulnerability documents into a foreign cluster's namespace, corrupting that cluster's security posture data. No public exploit has been identified at time of analysis; exploitation is constrained to pre-release beta deployments and requires an already-enrolled agent, substantially limiting real-world exposure.
Poisoned-pipeline command injection in Wazuh's GitHub Actions CI/CD workflows (all revisions before commit 44bf114) lets an unauthenticated external attacker run arbitrary shell commands on the project's self-hosted runners by submitting a fork pull request containing a crafted VERSION.json. Because the JSON is read into environment variables that are interpolated verbatim into workflow run steps, shell metacharacters break out into command execution, permitting theft of CI secrets such as GITHUB_TOKEN and AWS credentials. There is no public exploit identified at time of analysis, but the technique (untrusted fork input on self-hosted runners) is well-understood and the vendor has already merged a fix.
Authenticated remote code execution in Wazuh's Cluster Distributed API (DAPI) lets any peer holding the shared cluster key coerce the master node into deserializing an attacker-controlled callable (CWE-502) and running it under a forged RBAC context, yielding full manager compromise. Rated CVSS 9.1 and affecting all cluster deployments from 4.0.0 up to the 4.14.5 fix, it combines an overly broad deserialization allowlist with client-controlled authorization to bypass permission checks entirely. SSVC records a proof-of-concept, so publicly available exploit code exists, though EPSS remains low at 0.19% (9th percentile), consistent with a signal that requires possession of the cluster key rather than opportunistic mass exploitation.
Sensitive file disclosure in the Wazuh Manager (versions 4.0.0-4.10.3 and 4.11.0-4.14.4) allows a malicious enrolling agent to exfiltrate manager secrets by abusing the group parameter during enrollment. The authd enrollment daemon fails to filter path traversal ("..") sequences in the agent-selected group name, so remoted later builds shared-configuration paths that reach /var/ossec/etc and stream files such as client.keys, ossec.conf, and internal certificates to the attacker-controlled agent. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated CVSS 7.5 profile makes this a meaningful confidentiality risk for exposed manager enrollment services.
Denial of service in Wazuh's analysis engine (wazuh-analysisd) lets an unauthenticated remote attacker permanently halt SIEM alert processing on Wazuh manager versions 1.0.0 through 4.14.4. Because the official wazuh/wazuh-docker deployment ships with password-less agent enrollment enabled by default, an attacker can register as an agent and send a crafted rootcheck event that overflows a fixed 30-byte heap buffer, crashing the daemon while the dashboard and API keep showing stale data - silently blinding the SIEM. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Memory exhaustion denial-of-service in Wazuh's cluster protocol parser affects all deployments running versions 3.9.0 through 4.14.4. The cluster service reads an attacker-supplied payload length from an incoming message header and allocates memory of that size before performing any authentication or decryption, enabling unauthenticated adjacent-network attackers to exhaust system memory and crash the cluster service. No public exploit or CISA KEV listing exists at time of analysis; vendor-released patch 4.14.5 is available.
Rate-limit bypass in the Wazuh server API (versions 4.6.0 up to but not including 4.14.5) lets an authenticated client inject events into analysisd beyond the administrator-configured global request cap. A logic error in CheckRateLimitsMiddleware.dispatch() makes the /events endpoint's hardcoded 30/min check overwrite the general max_request_per_minute result, so /events requests keep succeeding even after the global limit is exhausted. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and CISA SSVC records no known exploitation.
Remote denial-of-service and potential heap corruption in the Wazuh manager's wazuh-remoted daemon allows any enrolled agent to crash the manager's agent-communication process, instantly severing all agent connections across the entire deployment. Affected versions span 3.0.0 through 4.14.4; a secondary code path triggered by the same underflow may permit heap memory write primitives beyond pure DoS. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low exploitation barrier - any enrolled agent suffices - makes it a meaningful insider or supply-chain risk for Wazuh-dependent SOC environments.
Local privilege escalation and silent denial-of-service in the Wazuh Windows agent (versions 4.6.0 through 4.14.4) arise from a heap-based buffer overflow in the syscheck registry-monitoring component. Because wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, a low-privileged local user who creates a 255-character registry subkey under a monitored wildcard path can trigger an out-of-bounds heap write, either blinding the agent or potentially executing code as SYSTEM. Proof-of-concept exploit code exists (SSVC: poc), but it is not in CISA KEV and EPSS is very low (0.09%, 1st percentile), consistent with the local-only, non-automatable attack profile.
NDJSON injection in Wazuh Manager before 5.0.0-beta3 lets any enrolled agent smuggle arbitrary OpenSearch bulk operations because the DataValue.index field is not escaped when the manager builds inventory-sync bulk requests. Because those requests execute under the manager's OpenSearch admin credentials, a single low-trust agent can delete documents, tamper with alerts, and manipulate SIEM state across all other agents. Rated CVSS 10.0 by the reporter (VulnCheck); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in Wazuh wazuh-modulesd (all releases before 5.0.0-beta3) lets an enrolled agent crash the manager's inventory synchronization module by sending a verifier-valid FlatBuffer DataValue message that omits the optional id field, triggering a null pointer dereference (CWE-476). Exploitation requires only a valid enrolled agent (PR:L) over the network with no user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is availability-only - no data confidentiality or integrity loss - but it can repeatedly take down central inventory sync, blinding a security monitoring deployment.
Heap buffer underwrite vulnerabilities in Wazuh Manager's remoted component allow an authenticated agent to corrupt the manager process heap, causing denial of service and potential code execution. Wazuh versions 4.0.0 through 4.14.3 are affected across all platforms where the manager role is deployed. A public proof-of-concept exists per SSVC data, though EPSS remains very low at 0.04% (12th percentile) and the vulnerability has not been confirmed as actively exploited in CISA KEV, suggesting exploitation is feasible but has not yet reached widespread use.
Wazuh Manager (4.4.0 through 4.14.3) contains a path traversal vulnerability in the cluster synchronization routine that allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. Writing to sensitive locations such as cron directories or Python module paths leads to remote code execution. CVSS 9.0 Critical (network-accessible, high privilege required, scope changed). Patch available in v4.14.4; no active exploitation identified.
Stack-based buffer overflow in wazuh-remoted's print_hex_string() function exposes Wazuh 4.8.0 through 4.14.3 to unauthenticated remote exploitation via TCP/1514, reachable before any agent authentication logic executes. The overflow stems from a C signed-char sign-extension defect where bytes ≥ 0x80 are rendered as 8-character hex strings instead of 2, overflowing a fixed 2049-byte stack buffer; a secondary unauthenticated path independently enables remote log amplification capable of exhausting disk and I/O on the monitoring host. No public exploit has been confirmed as actively exploited (not in CISA KEV), though SSVC assesses a proof-of-concept exists and the attack is automatable at scale.
Wazuh's server API brute-force protection on POST /security/user/authenticate is bypassable via concurrent request flooding in versions 4.0.0 through 4.14.3, allowing unauthenticated remote attackers to submit substantially more credential guesses than the configured max_login_attempts policy (default: 50) permits. The race condition in the IP-block enforcement logic processes parallel HTTP bursts before the counter triggers a block, effectively multiplying password guessing capacity - for example, processing 100 attempts where only 50 should be permitted. No public exploit is confirmed in KEV, but SSVC classifies exploitation status as POC and automatable, while EPSS at 0.05% (14th percentile) indicates limited observed in-the-wild activity. Vendor-released patch version 4.14.4 resolves the issue.
Heap-based buffer underwrite in Wazuh's GetAlertData function (versions 1.0.0 through 4.14.3) allows a threat actor who has already compromised a Wazuh agent to corrupt heap metadata on the manager or agent host by injecting a specially crafted alert into the log file monitored by wazuh-logcollector. The root cause is an unsigned integer underflow combined with pointer arithmetic wrapping that causes a NULL byte write exactly one byte before the start of a strdup-allocated buffer, corrupting adjacent heap metadata. No active exploitation is confirmed (absent from CISA KEV), though SSVC classifies a POC as existing; EPSS at 0.01% (2nd percentile) reflects very low observed exploitation probability, and a vendor-released patch is available in version 4.14.4.
GitHub Actions workflow artifacts in Wazuh version 4.12.0 expose GITHUB_TOKEN credentials that unauthenticated network attackers can extract and use within a limited time window to push malicious commits or alter release tags in the project repository. The vulnerability carries a CVSS 4.0 score of 8.3 with high integrity impact and low availability impact. No public exploit identified at time of analysis, though the vulnerability is classified under authentication bypass tags by VulnCheck.
Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Wazuh Manager authd service through version 4.7.3 fails to properly restrict client-initiated SSL/TLS renegotiation, enabling remote attackers to trigger denial of service by flooding the service with excessive renegotiation requests that exhaust CPU resources and render the authentication daemon unavailable. The vulnerability affects all Wazuh Manager installations up to and including version 4.7.3, requires no authentication or user interaction, and can be exploited over the network by any remote actor. No public exploit code or active exploitation has been confirmed at this time, though the straightforward nature of renegotiation-based DoS attacks and moderate CVSS score of 6.9 indicate practical exploitability.
Wazuh authd daemon contains a heap-buffer overflow vulnerability (CWE-125) triggered by specially crafted input from authenticated remote users, causing memory corruption and denial of service to the authentication daemon. The vulnerability affects all versions of Wazuh (CPE: cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*) and requires authenticated network access to exploit; no public exploit code or active exploitation has been confirmed at this time.
Stack-based buffer overflow in Wazuh manager versions 3.9.0 through 4.14.3 allows remote attackers with high privileges to crash the `wazuh-analysisd` service via malformed JSON events, resulting in denial of service. The vulnerability stems from unsafe use of sprintf with floating-point format specifiers in the Security Configuration Assessment decoder, and may potentially enable remote code execution on affected Wazuh installations.
Stack-based buffer overflow in Wazuh 4.4.0 through 4.14.2 allows authenticated remote attackers with high privileges to trigger an integer underflow in the database synchronization module, causing denial of service or potential code execution. The vulnerability exists in SQL query construction logic within wdb_delta_event.c where improper size calculations on buffers exceeding 2048 bytes can corrupt the stack. A patch is available in version 4.14.3.
Denial of service in Wazuh 4.3.0 through 4.14.2 allows unauthenticated attackers to exhaust API resources by sending crafted Bearer token requests that trigger blocking disk I/O operations in the authentication middleware, preventing the single-threaded event loop from processing legitimate connections. The vulnerability exists because synchronous file operations are called on every API request without proper resource constraints, enabling attackers to starve the application of CPU availability with relatively low request volumes. No patch is currently available.
Privilege escalation in Wazuh Manager versions 3.9.0 through 4.14.2 allows authenticated cluster nodes to achieve unauthenticated root code execution by exploiting insecure file permissions in the cluster synchronization protocol. An attacker with cluster node access can overwrite the manager's configuration file to inject malicious commands that are subsequently executed with root privileges by the logcollector service. This vulnerability affects multi-node Wazuh deployments and has no available patch.
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achieve remote code execution with root privileges on the master node. The vulnerability affects Wazuh versions 4.0.0 through 4.14.2 and poses severe risk to organizations using Wazuh in distributed deployments, as compromise of any single worker node can lead to full cluster takeover. While no active exploitation has been reported (not in KEV), proof-of-concept materials are publicly available via the Google Drive link in the advisory.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated low severity (CVSS 1.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable. Public exploit code available.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that allows attackers with control over the Wazuh server or possession of agent keys to redirect agents to malicious UNC paths, resulting in NetNTLMv2 hash leakage. The leaked hash can be relayed for remote code execution or abused for privilege escalation to SYSTEM level via AD CS certificate forging. This vulnerability represents a critical supply-chain/credential-leakage risk for Windows environments using Wazuh, though exploitation requires elevated privileges (high PR requirement) and knowledge of agent keys or server compromise.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI that allows remote code execution on Wazuh management servers.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated high severity (CVSS 7.4), this vulnerability is no authentication required. No vendor patch available.
Wazuh is a security detection, visibility, and compliance open source project. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Response endpoint. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Wazuh Manager in Wazuh through 4.1.5 is affected by a remote Integer Underflow vulnerability that might lead to denial of service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversal by leveraging full access to the associated OSSEC server. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Cleartext cluster key disclosure in Wazuh 4.14.0-4.14.6 allows any low-privilege API user with the default readonly or cluster_readonly role to retrieve the shared secret that authenticates and encrypts all inter-node cluster traffic. The GET /cluster/local/config endpoint was missing the mask_sensitive_config decorator applied to every sibling config endpoint, causing the cluster.key field to be returned unredacted to accounts that are explicitly denied update-config permission. The severity of this information disclosure is amplified by prior Wazuh advisories that establish cluster-peer remote code execution chains contingent on possessing the cluster key, making this a practical stepping stone to full cluster compromise. No public exploit has been identified at time of analysis and the vulnerability is not in the CISA KEV catalog.
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running versions 4.4.0 through 4.14.6. A peer that possesses the shared cluster key can abuse the file-synchronization routine to drop, overwrite, or delete files at attacker-chosen paths under /var/ossec - including scripts executed as root - because the worker's non-merged sync branch never verifies that a synced file matches the directory declared by its cluster_item_key. This is an incomplete fix for CVE-2026-30893, and no public exploit has been identified at time of analysis; it is fixed in 4.14.7.
Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuitively makes hardened accounts more exposed than default ones. Any authenticated low-privilege user whose role includes an explicit DENY on config-update actions can issue a single GET request to the manager configuration API with `raw=true` and receive the full `ossec.conf` XML with `cluster.key` in cleartext - because the broken gate treats the mere presence of a deny-rule entry as proof of update permission, disabling masking entirely. No public exploit has been identified at time of analysis, but the fix is available in 4.14.7 and the root cause is confirmed by vendor advisory and merged commit.
NULL pointer dereference in Wazuh agent enrollment (versions 4.0.0-4.14.6) allows a network-positioned attacker operating a rogue manager or performing a man-in-the-middle attack to deterministically crash the agent process by supplying a malformed key response containing fewer than four space-separated fields. The flaw resides in `w_enrollment_process_agent_key()` in `src/shared/enrollment_op.c`, which passes unvalidated NULL entries from `OS_StrBreak()` directly into `OS_IsValidName()`, where an unguarded `strlen()` call on a NULL pointer terminates the agent. The attack is constrained by high complexity conditions (no CA certificate configured, or active MITM capability), and no public exploit code or CISA KEV listing has been identified at time of analysis. The issue is fixed in Wazuh 4.14.7.
Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who controls a monitored log source to inject arbitrary arguments into firewall and account-management commands executing as root. Five scripts handling the srcip alert field (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP format validation, and disable-account.c passes the dstuser field to passwd/chuser with only a root-name check, enabling injection into pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess concatenation in wpopenv() amplifies the impact by allowing space-delimited srcip values to append additional process arguments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or delete arbitrary files as root by injecting directory traversal sequences into the srcip field of alert-triggering log events. Versions prior to 4.14.7 are affected when ip-customblock is configured as an active response - the block action creates an empty file at an attacker-controlled path, while the unblock action deletes it, both executing as root and enabling destruction of credentials, configuration, or other critical files. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the missing validation is trivially observable by comparing ip-customblock.c against its sibling scripts.
SQL injection in Wazuh's File Integrity Monitoring subsystem allows a local low-privileged user on non-Windows systems to manipulate the FIM SQLite database by creating a specially crafted filename in any monitored directory. The `wazuh-syscheckd` daemon in versions 4.6.0 through 4.14.5 concatenates unsanitized file paths directly into SQLite row filter predicates in `DB::getFile()` and `DB::searchFile()`, enabling UNION SELECT injection when the path is processed. No public exploit or KEV listing exists; however, the vendor-merged PR test suite contains a working injection payload, and the impact - falsification or suppression of FIM integrity alerts - directly undermines the product's core security monitoring function.
Log injection in Wazuh's REST API (versions 4.4.0 through pre-4.14.6 and 5.0.0-beta1 through pre-5.0.0-beta2) allows an unauthenticated remote attacker to corrupt plain-text audit log integrity by embedding carriage return or line feed characters in the Basic authentication username field. Because the API middleware decodes the username before credential validation and passes the raw value to the access logger without control-character neutralization, the attacker can forge log entries, suppress evidence of prior activity, or poison upstream log aggregation pipelines. No public exploit has been identified at time of analysis, and the JSON log format is unaffected; the vendor-released patch is available in 4.14.6 and 5.0.0-beta2.
Stack-based buffer overflow in Wazuh's wazuh-authd enrollment daemon (versions 4.5.0 through 4.14.5 and 5.0.0-beta1) allows unauthenticated remote attackers to crash the service by sending a crafted nine-byte version string in the enrollment 'V:' field, triggering unsafe stack memory reads and a null byte write into adjacent stack frames. The vulnerable code path in compare_wazuh_versions() is reachable before authentication over TCP port 1515 when anonymous TLS enrollment is enabled, resulting in a denial of service against the agent enrollment service. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; vendor-released patches are available in versions 4.14.6 and 5.0.0-beta2.
Path-traversal-driven remote code execution in Wazuh 4.3.0 through 4.14.5 (and 5.0.0-beta1/beta2) lets a cluster peer that holds the shared Fernet key overwrite security-sensitive files on the master node. Because the non-merged branch of process_files_from_worker() in master.py trusts the peer-supplied file_path from files_metadata.json without confining it under the directory implied by cluster_item_key, an attacker can replace /var/ossec/etc/ossec.conf to configure root-executed commands and gain code execution on the next service reload. No public exploit identified at time of analysis, but a vendor fix and the fixing commit are public, making the root cause easy to study.
Privilege escalation in Wazuh 4.9.0-4.10.3 and 4.11.0-4.14.5 allows any authenticated user holding the users_admin role to overwrite the password of protected built-in administrator accounts - including the wazuh superuser - via a logic flaw in the PUT /security/users/{user_id} REST API endpoint. The API controller passes request.get("user"), which resolves to None because that key is absent from the request object, instead of extracting the authenticated principal from the JWT token; remove_nones_to_dict() then silently strips the None before it reaches the reserved-account authorization guard in the framework layer, causing the protection check to fail open. The issue is confirmed fixed in v4.10.4 and v4.14.6; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file deletion on a Wazuh manager via the cluster synchronization protocol allows a cluster-authenticated attacker to destroy critical files including ossec.conf, jwt_secret.json, and TLS certificates, effectively disabling the manager or invalidating all API authentication tokens. The flaw spans Wazuh 4.0.0 through 4.14.5 and the 5.0.0-beta2 pre-release, rooted in missing path canonicalization inside the cluster file-receive cleanup handler. No public exploit or active exploitation has been identified at time of analysis; however, CVSS 4.0 rates the vulnerable-system impact as High across confidentiality, integrity, and availability, making this a high-priority patch for any clustered Wazuh deployment.
Stack out-of-bounds write in Wazuh's root-level remoted daemon allows an authenticated agent to crash manager message processing by sending a specially crafted compressed payload over TCP port 1514. Versions 1.0.0 through 4.14.5 (stable) and 5.0.0-beta1 are affected; the decompression function writes a null terminator one byte beyond the stack buffer boundary when the message expands to exactly OS_MAXSTR bytes, corrupting the daemon stack and disrupting all agent communications. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; fixed versions 4.14.6 and 5.0.0-beta2 are available.
Memory exhaustion in Wazuh's cluster protocol allows an authenticated cluster node to crash the master by sending unbounded allocation requests via the new_str command or the divided-message reassembly path. Affected deployments span versions 3.9.0 through 4.14.4 and 5.0.0-beta1, with the primary operational impact being disruption of agent connectivity and alert processing across the monitored environment. No public exploit has been identified at time of analysis; however, the published patch diff fully exposes both vulnerable code paths, lowering the barrier for future exploit development.
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-privilege API user with manager:read permission can retrieve the plaintext Fernet cluster key via the raw configuration endpoint, then use it to impersonate a cluster worker node and inject attacker-controlled RBAC permissions that grant full administrative access. The master node's unconditional trust in worker-supplied authorization context (CWE-863 - Incorrect Authorization) allows an attacker to create admin users, access stored credentials and API tokens, modify platform configuration, and execute arbitrary commands across all Wazuh-managed agents. No public exploit has been identified at time of analysis; the vendor-released fix is confirmed in version 4.14.5.
Username enumeration via observable timing discrepancy in Wazuh's authentication layer exposes valid account names to unauthenticated remote attackers across all 4.x deployments from 4.0.0 and the 5.0.0-beta1 pre-release. The root cause is an asymmetric code path in AuthenticationManager.check_user() - nonexistent usernames return immediately while valid usernames trigger an expensive bcrypt hash computation, creating a reliably measurable latency gap of roughly 100-300 ms versus sub-millisecond response. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive reliably enables targeted credential-stuffing or brute-force follow-on attacks.
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in versions 4.0.0 through 4.14.5 and the 5.0.0-beta line up to 5.0.0-beta3. A malicious or compromised cluster peer that possesses the shared Fernet key can smuggle directory-traversal sequences through merge_type/name values or a merged-file header, causing the master node to write attacker-controlled files (e.g. /var/ossec/etc/ossec.conf) outside the intended cluster item directory; overwriting ossec.conf lets the attacker define root-executed commands that fire when Wazuh services reload. No public exploit has been identified at time of analysis, and the issue is not in CISA KEV; the vendor fix landed in 4.14.6 and 5.0.0-beta3.
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that already holds the shared cluster Fernet key coerce the master into returning any file it can read over the encrypted cluster channel. By retrieving /var/ossec/api/configuration/security/private_key.pem, that peer can forge administrator REST API tokens offline and exercise full administrative privileges without ever creating an account. No public exploit identified at time of analysis; the underlying fix is confirmed in the vendor advisory and shipped in 4.14.6 and 5.0.0-beta3.
Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node, exploiting unsafe Python builtin resolution in the distributed API merge path. Affected versions span 4.0.0 through 4.14.5 and 5.0.0-beta1; the vulnerable code in framework/wazuh/core/results.py called getattr(builtins, type_) with attacker-supplied strings from worker JSON responses, enabling exec or eval injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is mechanically trivial once a worker node is controlled, with the payload executing as root on the master.
Memory exhaustion in Wazuh Manager 4.4.0 through 4.14.6 allows authenticated cluster peers to crash the wazuh-clusterd daemon on the master node by submitting a specially crafted zip bomb archive during cluster synchronization. The fdecompress_files() function in cluster.py invoked zlib.decompress() without any decompressed-size limit, enabling an attacker holding a valid cluster Fernet key to force unbounded memory allocation from a tiny compressed payload. No public exploit has been identified and the vulnerability is absent from CISA KEV; Wazuh has released a fix in version 4.14.7 via GitHub pull request #37119.
Path traversal via unsanitized cluster node names in Wazuh Manager 4.0.0 through 4.14.5 enables authenticated cluster peers to delete arbitrary directory contents on the master node. An attacker holding a valid cluster Fernet key can supply a traversal-shaped node name (e.g., '../../etc') in the cluster hello handshake, then disconnect - causing the master's peer cleanup routine to recursively remove the contents of directories outside the intended cluster queue path, writable by the wazuh user. No public exploit has been identified at time of analysis, and a vendor patch is available in 4.14.6.
CPU exhaustion in Wazuh Manager 4.0.0-4.14.6 and 5.0.0-beta2 allows authenticated API users with the allow_run_as permission to fully deny service to all other API consumers by submitting arbitrarily deeply nested JSON to the POST /security/user/authenticate/run_as endpoint. The API framework processes these structures recursively without any depth or size limit, consuming CPU proportionally to nesting depth until the process becomes unresponsive. No public exploit identified at time of analysis, though the attack primitive is trivially constructible from the CVE description alone.
Path traversal in Wazuh Manager 4.0.0 through 4.14.5 allows unauthenticated remote attackers to destroy the manager's queue directory structure and halt all Wazuh services by registering an agent whose name begins with a dot (e.g., ".."). Two compounding weaknesses drive the impact: OS_IsValidName() failed to reject dot-prefixed agent names, and delete_diff() performs unsafe path concatenation that resolves the traversal sequence to the parent queue directory, wiping its subdirectories. Recovery requires manual intervention, creating a complete and sustained loss of SIEM and XDR visibility. No public exploit or CISA KEV listing has been identified at time of analysis.
Cluster attribution spoofing in Wazuh 5.0.0-beta1 and beta2 allows an authenticated enrolled agent to forge wazuh.cluster.name and cluster_node values in inventory-sync FlatBuffer Start messages, because the server validates only the agentid against the enrolled identity while accepting arbitrary cluster metadata fields from the caller. In shared-indexer multi-cluster deployments where numeric agent IDs collide across clusters, a malicious agent can inject inventory and vulnerability documents into a foreign cluster's namespace, corrupting that cluster's security posture data. No public exploit has been identified at time of analysis; exploitation is constrained to pre-release beta deployments and requires an already-enrolled agent, substantially limiting real-world exposure.
Poisoned-pipeline command injection in Wazuh's GitHub Actions CI/CD workflows (all revisions before commit 44bf114) lets an unauthenticated external attacker run arbitrary shell commands on the project's self-hosted runners by submitting a fork pull request containing a crafted VERSION.json. Because the JSON is read into environment variables that are interpolated verbatim into workflow run steps, shell metacharacters break out into command execution, permitting theft of CI secrets such as GITHUB_TOKEN and AWS credentials. There is no public exploit identified at time of analysis, but the technique (untrusted fork input on self-hosted runners) is well-understood and the vendor has already merged a fix.
Authenticated remote code execution in Wazuh's Cluster Distributed API (DAPI) lets any peer holding the shared cluster key coerce the master node into deserializing an attacker-controlled callable (CWE-502) and running it under a forged RBAC context, yielding full manager compromise. Rated CVSS 9.1 and affecting all cluster deployments from 4.0.0 up to the 4.14.5 fix, it combines an overly broad deserialization allowlist with client-controlled authorization to bypass permission checks entirely. SSVC records a proof-of-concept, so publicly available exploit code exists, though EPSS remains low at 0.19% (9th percentile), consistent with a signal that requires possession of the cluster key rather than opportunistic mass exploitation.
Sensitive file disclosure in the Wazuh Manager (versions 4.0.0-4.10.3 and 4.11.0-4.14.4) allows a malicious enrolling agent to exfiltrate manager secrets by abusing the group parameter during enrollment. The authd enrollment daemon fails to filter path traversal ("..") sequences in the agent-selected group name, so remoted later builds shared-configuration paths that reach /var/ossec/etc and stream files such as client.keys, ossec.conf, and internal certificates to the attacker-controlled agent. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated CVSS 7.5 profile makes this a meaningful confidentiality risk for exposed manager enrollment services.
Denial of service in Wazuh's analysis engine (wazuh-analysisd) lets an unauthenticated remote attacker permanently halt SIEM alert processing on Wazuh manager versions 1.0.0 through 4.14.4. Because the official wazuh/wazuh-docker deployment ships with password-less agent enrollment enabled by default, an attacker can register as an agent and send a crafted rootcheck event that overflows a fixed 30-byte heap buffer, crashing the daemon while the dashboard and API keep showing stale data - silently blinding the SIEM. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Memory exhaustion denial-of-service in Wazuh's cluster protocol parser affects all deployments running versions 3.9.0 through 4.14.4. The cluster service reads an attacker-supplied payload length from an incoming message header and allocates memory of that size before performing any authentication or decryption, enabling unauthenticated adjacent-network attackers to exhaust system memory and crash the cluster service. No public exploit or CISA KEV listing exists at time of analysis; vendor-released patch 4.14.5 is available.
Rate-limit bypass in the Wazuh server API (versions 4.6.0 up to but not including 4.14.5) lets an authenticated client inject events into analysisd beyond the administrator-configured global request cap. A logic error in CheckRateLimitsMiddleware.dispatch() makes the /events endpoint's hardcoded 30/min check overwrite the general max_request_per_minute result, so /events requests keep succeeding even after the global limit is exhausted. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and CISA SSVC records no known exploitation.
Remote denial-of-service and potential heap corruption in the Wazuh manager's wazuh-remoted daemon allows any enrolled agent to crash the manager's agent-communication process, instantly severing all agent connections across the entire deployment. Affected versions span 3.0.0 through 4.14.4; a secondary code path triggered by the same underflow may permit heap memory write primitives beyond pure DoS. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low exploitation barrier - any enrolled agent suffices - makes it a meaningful insider or supply-chain risk for Wazuh-dependent SOC environments.
Local privilege escalation and silent denial-of-service in the Wazuh Windows agent (versions 4.6.0 through 4.14.4) arise from a heap-based buffer overflow in the syscheck registry-monitoring component. Because wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, a low-privileged local user who creates a 255-character registry subkey under a monitored wildcard path can trigger an out-of-bounds heap write, either blinding the agent or potentially executing code as SYSTEM. Proof-of-concept exploit code exists (SSVC: poc), but it is not in CISA KEV and EPSS is very low (0.09%, 1st percentile), consistent with the local-only, non-automatable attack profile.
NDJSON injection in Wazuh Manager before 5.0.0-beta3 lets any enrolled agent smuggle arbitrary OpenSearch bulk operations because the DataValue.index field is not escaped when the manager builds inventory-sync bulk requests. Because those requests execute under the manager's OpenSearch admin credentials, a single low-trust agent can delete documents, tamper with alerts, and manipulate SIEM state across all other agents. Rated CVSS 10.0 by the reporter (VulnCheck); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in Wazuh wazuh-modulesd (all releases before 5.0.0-beta3) lets an enrolled agent crash the manager's inventory synchronization module by sending a verifier-valid FlatBuffer DataValue message that omits the optional id field, triggering a null pointer dereference (CWE-476). Exploitation requires only a valid enrolled agent (PR:L) over the network with no user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is availability-only - no data confidentiality or integrity loss - but it can repeatedly take down central inventory sync, blinding a security monitoring deployment.
Heap buffer underwrite vulnerabilities in Wazuh Manager's remoted component allow an authenticated agent to corrupt the manager process heap, causing denial of service and potential code execution. Wazuh versions 4.0.0 through 4.14.3 are affected across all platforms where the manager role is deployed. A public proof-of-concept exists per SSVC data, though EPSS remains very low at 0.04% (12th percentile) and the vulnerability has not been confirmed as actively exploited in CISA KEV, suggesting exploitation is feasible but has not yet reached widespread use.
Wazuh Manager (4.4.0 through 4.14.3) contains a path traversal vulnerability in the cluster synchronization routine that allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. Writing to sensitive locations such as cron directories or Python module paths leads to remote code execution. CVSS 9.0 Critical (network-accessible, high privilege required, scope changed). Patch available in v4.14.4; no active exploitation identified.
Stack-based buffer overflow in wazuh-remoted's print_hex_string() function exposes Wazuh 4.8.0 through 4.14.3 to unauthenticated remote exploitation via TCP/1514, reachable before any agent authentication logic executes. The overflow stems from a C signed-char sign-extension defect where bytes ≥ 0x80 are rendered as 8-character hex strings instead of 2, overflowing a fixed 2049-byte stack buffer; a secondary unauthenticated path independently enables remote log amplification capable of exhausting disk and I/O on the monitoring host. No public exploit has been confirmed as actively exploited (not in CISA KEV), though SSVC assesses a proof-of-concept exists and the attack is automatable at scale.
Wazuh's server API brute-force protection on POST /security/user/authenticate is bypassable via concurrent request flooding in versions 4.0.0 through 4.14.3, allowing unauthenticated remote attackers to submit substantially more credential guesses than the configured max_login_attempts policy (default: 50) permits. The race condition in the IP-block enforcement logic processes parallel HTTP bursts before the counter triggers a block, effectively multiplying password guessing capacity - for example, processing 100 attempts where only 50 should be permitted. No public exploit is confirmed in KEV, but SSVC classifies exploitation status as POC and automatable, while EPSS at 0.05% (14th percentile) indicates limited observed in-the-wild activity. Vendor-released patch version 4.14.4 resolves the issue.
Heap-based buffer underwrite in Wazuh's GetAlertData function (versions 1.0.0 through 4.14.3) allows a threat actor who has already compromised a Wazuh agent to corrupt heap metadata on the manager or agent host by injecting a specially crafted alert into the log file monitored by wazuh-logcollector. The root cause is an unsigned integer underflow combined with pointer arithmetic wrapping that causes a NULL byte write exactly one byte before the start of a strdup-allocated buffer, corrupting adjacent heap metadata. No active exploitation is confirmed (absent from CISA KEV), though SSVC classifies a POC as existing; EPSS at 0.01% (2nd percentile) reflects very low observed exploitation probability, and a vendor-released patch is available in version 4.14.4.
GitHub Actions workflow artifacts in Wazuh version 4.12.0 expose GITHUB_TOKEN credentials that unauthenticated network attackers can extract and use within a limited time window to push malicious commits or alter release tags in the project repository. The vulnerability carries a CVSS 4.0 score of 8.3 with high integrity impact and low availability impact. No public exploit identified at time of analysis, though the vulnerability is classified under authentication bypass tags by VulnCheck.
Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Wazuh Manager authd service through version 4.7.3 fails to properly restrict client-initiated SSL/TLS renegotiation, enabling remote attackers to trigger denial of service by flooding the service with excessive renegotiation requests that exhaust CPU resources and render the authentication daemon unavailable. The vulnerability affects all Wazuh Manager installations up to and including version 4.7.3, requires no authentication or user interaction, and can be exploited over the network by any remote actor. No public exploit code or active exploitation has been confirmed at this time, though the straightforward nature of renegotiation-based DoS attacks and moderate CVSS score of 6.9 indicate practical exploitability.
Wazuh authd daemon contains a heap-buffer overflow vulnerability (CWE-125) triggered by specially crafted input from authenticated remote users, causing memory corruption and denial of service to the authentication daemon. The vulnerability affects all versions of Wazuh (CPE: cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*) and requires authenticated network access to exploit; no public exploit code or active exploitation has been confirmed at this time.
Stack-based buffer overflow in Wazuh manager versions 3.9.0 through 4.14.3 allows remote attackers with high privileges to crash the `wazuh-analysisd` service via malformed JSON events, resulting in denial of service. The vulnerability stems from unsafe use of sprintf with floating-point format specifiers in the Security Configuration Assessment decoder, and may potentially enable remote code execution on affected Wazuh installations.
Stack-based buffer overflow in Wazuh 4.4.0 through 4.14.2 allows authenticated remote attackers with high privileges to trigger an integer underflow in the database synchronization module, causing denial of service or potential code execution. The vulnerability exists in SQL query construction logic within wdb_delta_event.c where improper size calculations on buffers exceeding 2048 bytes can corrupt the stack. A patch is available in version 4.14.3.
Denial of service in Wazuh 4.3.0 through 4.14.2 allows unauthenticated attackers to exhaust API resources by sending crafted Bearer token requests that trigger blocking disk I/O operations in the authentication middleware, preventing the single-threaded event loop from processing legitimate connections. The vulnerability exists because synchronous file operations are called on every API request without proper resource constraints, enabling attackers to starve the application of CPU availability with relatively low request volumes. No patch is currently available.
Privilege escalation in Wazuh Manager versions 3.9.0 through 4.14.2 allows authenticated cluster nodes to achieve unauthenticated root code execution by exploiting insecure file permissions in the cluster synchronization protocol. An attacker with cluster node access can overwrite the manager's configuration file to inject malicious commands that are subsequently executed with root privileges by the logcollector service. This vulnerability affects multi-node Wazuh deployments and has no available patch.
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achieve remote code execution with root privileges on the master node. The vulnerability affects Wazuh versions 4.0.0 through 4.14.2 and poses severe risk to organizations using Wazuh in distributed deployments, as compromise of any single worker node can lead to full cluster takeover. While no active exploitation has been reported (not in KEV), proof-of-concept materials are publicly available via the Google Drive link in the advisory.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated low severity (CVSS 1.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable. Public exploit code available.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that allows attackers with control over the Wazuh server or possession of agent keys to redirect agents to malicious UNC paths, resulting in NetNTLMv2 hash leakage. The leaked hash can be relayed for remote code execution or abused for privilege escalation to SYSTEM level via AD CS certificate forging. This vulnerability represents a critical supply-chain/credential-leakage risk for Windows environments using Wazuh, though exploitation requires elevated privileges (high PR requirement) and knowledge of agent keys or server compromise.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI that allows remote code execution on Wazuh management servers.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated high severity (CVSS 7.4), this vulnerability is no authentication required. No vendor patch available.
Wazuh is a security detection, visibility, and compliance open source project. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Response endpoint. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Wazuh Manager in Wazuh through 4.1.5 is affected by a remote Integer Underflow vulnerability that might lead to denial of service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversal by leveraging full access to the associated OSSEC server. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.