Executive brief
Wazuh is a threat detection and response platform used to monitor and protect enterprise networks. An attacker can send a crafted enrollment message to the authentication daemon before logging in, causing the server to crash or potentially execute unauthorized actions. This remotely accessible vulnerability requires no authentication and can disrupt security monitoring operations.
Technical details
The vulnerability is a combination of buffer over-read and stack memory corruption in the compare_wazuh_versions() function in src/shared/version_op.c. The function uses strncpy() to copy an attacker-controlled enrollment version field into a 10-byte stack buffer without ensuring NUL-termination; when the input is 9+ non-null bytes, subsequent strchr() and strtok() calls read beyond the buffer boundary and strtok() writes a null byte into adjacent stack memory. The vulnerable code path is reachable unauthenticated through wazuh-authd on TCP port 1515 when anonymous TLS enrollment is enabled. An attacker can achieve denial of service by crashing the daemon. The issue is fixed in versions 4.14.6 and 5.0.0-beta2 by explicitly ensuring NUL-termination of string buffers.
Affected products
- Wazuh Wazuh 4.5.0 through 4.14.5, 5.0.0-beta1
Timeline
- 2026-08-19: disclosed
- 2026-05-13: patched: Fix merged in version 4.14.6 and 5.0.0-beta2