Executive brief
Wazuh is an open-source security platform used to monitor and protect endpoints and cloud workloads. An attacker operating a rogue enrollment manager or intercepting enrollment traffic can crash Wazuh agents by sending a malformed enrollment response, causing service disruption. This attack requires no credentials and succeeds even in default deployments where agent-to-manager encryption is not configured.
Technical details
The vulnerability is a NULL pointer dereference in the enrollment key validation logic (w_enrollment_process_agent_key in src/shared/enrollment_op.c). When the enrollment manager response contains fewer than four space-separated fields, the OS_StrBreak() function leaves trailing array entries as NULL, but the downstream validator OS_IsValidName() calls strlen() on its argument without checking for NULL. An attacker can send a malformed response like "OSSEC K:'1'" that passes the first validation (ID check) but crashes when the second validator attempts to validate a NULL pointer. The vulnerability requires network access to the agent's enrollment flow and affects versions 4.0.0 through 4.14.6; a fix was released in version 4.14.7 that adds NULL field validation before calling validators.
Affected products
- Wazuh Wazuh 4.0.0 through 4.14.6
Timeline
- 2026-08-28: disclosed
- 2026-08-28: patched: Version 4.14.7