Juliancnn

**Name of the Vulnerable Software and Affected Versions** Wazuh Manager versions prior to 5.0.0-beta3 **Description** The software fails to escape the `DataValue.index` field when constructing OpenSearch bulk requests. This allows enrolled agents to inject arbitrary NDJSON (Newline Delimited JSON) operations. Attackers can smuggle delete, index, or update operations into bulk requests executed with the manager's admin credentials, which can lead to document deletion, alert tampering, and cross-agent SIEM state manipulation. **Recommendations** Update Wazuh Manager to version 5.0.0-beta3 or later.