CVE-2026-39359

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.10.3 Wazuh versions 4.11.0 through 4.14.4

Description A logic flaw exists in the Wazuh Manager enrollment daemon (authd) and synchronization daemon (remoted). The authd process fails to filter path traversal sequences, such as .., when agents select a group during enrollment. Although the manager uses wopendir() to check the group directory, the .. sequence allows it to reference the parent directory /var/ossec/etc and pass validation. Once this malicious group is stored in the global database, the remoted process uses the unchecked value to construct paths for configuration synchronization. This results in the exposure of sensitive files from /var/ossec/etc, including client.keys, ossec.conf, and internal certificates, which are sent to the agent's shared configuration stream.

Recommendations Update versions 4.0.0 through 4.10.3 to version 4.10.4. Update versions 4.11.0 through 4.14.4 to version 4.14.5.