Executive brief
Wazuh is a security platform used by organizations to monitor and respond to cyber threats across their infrastructure. A security flaw in the way the central manager handles new device registrations allows an attacker to trick the system into sharing sensitive internal files. This could result in the exposure of encryption keys and configuration data, potentially allowing an attacker to compromise the entire monitoring network.
Technical details
A logic flaw exists in the Wazuh Manager's enrollment daemon (authd) and synchronization daemon (remoted). The authd process fails to sanitize group names provided by agents during enrollment, allowing path traversal sequences like '..'. While the manager attempts to validate the group directory using wopendir(), the traversal sequence successfully resolves to the parent directory (/var/ossec/etc). Subsequently, the remoted process uses this unsanitized path to synchronize configurations, inadvertently including sensitive files such as client.keys, ossec.conf, and internal certificates in the agent's shared configuration stream. This allows an unauthenticated network attacker to exfiltrate critical secrets. The issue is fixed in versions 4.10.4 and 4.14.5.
Affected products
- Wazuh Wazuh Manager 4.0.0 - 4.10.3, 4.11.0 - 4.14.4
Timeline
- 2026-07-16: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: NVD publication date