CVE-2026-39359 Details
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects the Wazuh Manager's enrollment daemon (authd) and synchronization daemon (remoted). The authd process allows agents to select a group during enrollment but does not filter path traversal sequences such as "..." While the manager checks for the group directory using wopendir(), the ".." sequence references the parent directory (/var/ossec/etc), allowing it to pass validation. After the malicious group is accepted and stored in the manager's global database, the remoted process uses this unchecked value to build paths for agent configuration synchronization. As a result, sensitive files from /var/ossec/etc, such as client.keys, ossec.conf, and internal certificates, are included in the agent's shared configuration stream and exposed to the attacker. This issue has been fixed in versions 4.10.4 and 4.14.5.
A logic flaw has been identified in Wazuh Manager versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4. The vulnerability resides in the enrollment daemon (authd) and synchronization daemon (remoted). During the enrollment process, the authd daemon allows agents to specify a group but fails to properly sanitize the group name, enabling path traversal attacks. This unchecked group name is then used by the remoted daemon to access agent configuration files, inadvertently exposing sensitive data such as client.keys, ossec.conf, and internal certificates to the agent. This issue has been resolved in Wazuh versions 4.10.4 and 4.14.5.
Users can upgrade to Wazuh versions 4.10.4 or 4.14.5 to address this vulnerability. For those unable to upgrade, it is recommended to implement strict validation of group names in the enrollment daemon to prevent the use of path traversal sequences.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wazuh/wazuh/security/advisories/GHSA-6q95-fcwc-4h44 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/wazuh/wazuh/security/advisories/GHSA-6q95-fcwc-4h44 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wazuh wazuh | >= 4.0.0, < 4.10.4 >= 4.11.0, < 4.14.5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | Initial Analysis | [email protected] |
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |