Quick answers
- Is CVE-2026-45798 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45798 being exploited in the wild.
- How severe is CVE-2026-45798?
- High severity, with a CVSS score of 7.5, published 19 August 2026.
- Which products and versions are affected?
- Wazuh 4.5.0 through 4.14.5, 5.0.0-beta1.
- Is there a fix for CVE-2026-45798?
- A patch was published on 2026-05-13: Fix merged in version 4.14.6 and 5.0.0-beta2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45798 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-45798?
- Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a combination of buffer over-read and stack memory corruption in the compare_wazuh_versions() function in src/shared/version_op.c. The function uses strncpy() to copy an attacker-controlled enrollment version field into a 10-byte stack buffer without ensuring NUL-termination; when the input is 9+ non-null bytes, subsequent strchr() and strtok() calls read beyond the buffer boundary and strtok() writes a null byte into adjacent stack memory. The vulnerable code path is reachable unauthenticated through wazuh-authd on TCP port 1515 when anonymous TLS enrollment is enabled. An attacker can achieve denial of service by crashing the daemon. The issue is fixed in versions 4.14.6 and 5.0.0-beta2 by explicitly ensuring NUL-termination of string buffers.
Affected products
- Wazuh Wazuh 4.5.0 through 4.14.5, 5.0.0-beta1
Timeline
- 2026-08-19: disclosed
- 2026-05-13: patched: Fix merged in version 4.14.6 and 5.0.0-beta2