CVE-2026-39359
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A logic flaw in Wazuh Manager versions 4.0.0-4.10.3 and 4.11.0-4.14.4 affects the enrollment daemon (authd) and synchronization daemon (remoted). The authd process allows agents to select a group during enrollment without filtering path traversal sequences like "..", enabling access to files outside the intended directory. Sensitive files such as client.keys, ossec.conf, and internal certificates are exposed to the attacker.
Risk Assessment
An attacker can access sensitive configuration and authentication data of the Wazuh Manager, potentially leading to compromise of the security monitoring platform and further attacks on IT infrastructure.
Recommendation
Immediately upgrade Wazuh Manager to version 4.10.4 or 4.14.5, which fix this vulnerability. Before upgrading, consider restricting trust for registered agents and monitoring logs for suspicious group names.
Other vulnerabilities in Wazuh Manager
See all- CVE-2025-15615Medium
Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability, allowing remote attackers to cause a denial of service by sending excessive renegotiation requests.
- CVE-2026-32983Medium
The Wazuh Manager authd service in wazuh-manager packages through 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation, allowing remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lack of renegotiation limits to consume CPU resources and make the authd service unavailable.
Original NVD description (English source)
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects the Wazuh Manager's enrollment daemon (authd) and synchronization daemon (remoted). The authd process allows agents to select a group during enrollment but does not filter path traversal sequences such as "..." While the manager checks for the group directory using wopendir(), the ".." sequence references the parent directory (/var/ossec/etc), allowing it to pass validation. After the malicious group is accepted and stored in the manager's global database, the remoted process uses this unchecked value to build paths for agent configuration synchronization. As a result, sensitive files from /var/ossec/etc, such as client.keys, ossec.conf, and internal certificates, are included in the agent's shared configuration stream and exposed to the attacker. This issue has been fixed in versions 4.10.4 and 4.14.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS