CVE-2026-54084

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.6

Description A malicious or man-in-the-middle enrollment manager can cause a denial of service by crashing a Wazuh agent during the enrollment process. This occurs when the manager returns a malformed key response containing fewer than four fields, leading to a NULL pointer dereference. The w enrollment process agent key() routine splits the key into four space-separated fields but fails to verify their presence before validation. Specifically, OS StrBreak() leaves missing trailing entries as NULL, and OS IsValidName() subsequently calls strlen() on the NULL argument, terminating the agent process. This is possible when enrollment is permitted against an unverified manager due to the absence of a configured CA certificate.

Recommendations Update to version 4.14.7.