CVE-2026-56699
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Wazuh Manager before version 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin credentials, enabling document deletion, alert tampering, and cross-agent SIEM state manipulation.
Risk Assessment
The organization faces a risk of SIEM data integrity compromise, including alert falsification and unauthorized document deletion, which can lead to incorrect operational decisions and concealment of actual security incidents.
Recommendation
Immediately upgrade Wazuh Manager to version 5.0.0-beta3 or later, which includes a fix preventing NDJSON injection.
Original NVD description (English source)
Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin credentials, enabling document deletion, alert tampering, and cross-agent SIEM state manipulation.