PT-2026-60121

CVE-2026-56699

Published

2026-06-08

Updated

2026-07-15

Description by

CVSS 3.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wazuh Manager versions prior to 5.0.0-beta3

Description The software fails to escape the DataValue.index field when constructing OpenSearch bulk requests. This allows enrolled agents to inject arbitrary NDJSON (Newline Delimited JSON) operations. Attackers can smuggle delete, index, or update operations into bulk requests executed with the manager's admin credentials, which can lead to document deletion, alert tampering, and cross-agent SIEM state manipulation.

Recommendations Update Wazuh Manager to version 5.0.0-beta3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Juliancnn

Tarpeg007

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')