Description
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key response with fewer than four fields, causing a NULL pointer dereference. The  w_enrollment_process_agent_key()  routine splits the manager-provided key into four space-separated fields but does not verify that all fields are present before passing them to validators. Because OS_StrBreak() leaves missing trailing entries as NULL and OS_IsValidName() calls strlen() on its argument without a NULL check, a response such as  OSSEC K:'1'  reaches OS_IsValidName(NULL) and terminates the agent process. Since Wazuh permits enrollment against an unverified manager when no CA certificate is configured, an attacker operating a rogue manager or intercepting the enrollment flow can deterministically crash agents, resulting in denial of service. This issue is fixed in version 4.14.7.
Published: 2026-08-27
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A malicious or man‑in‑the‑middle enrollment manager can send a malformed key response with fewer than four space‑separated fields, causing a NULL pointer dereference in the agent’s enrollment routine. This results in the agent process terminating, effectively denying service to the protected endpoint. The weakness is a classic null dereference (CWE-476).

Affected Systems

The vulnerability affects the Wazuh open‑source security platform, specifically agent versions 4.0.0 through 4.14.6. An attacker can exploit any agent that enrolls from an unverified manager lacking a CA certificate.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. Exploitation requires control over or interception of the enrollment manager, typically over the network. Because the agent crashes deterministically when receiving the malformed response, a targeted denial of service can be achieved without privilege escalation.

Generated by OpenCVE AI on August 28, 2026 at 06:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade all Wazuh agents to version 4.14.7 or later, which incorporates the fixed enrollment routine.
  • Configure the agent to require a CA certificate for the enrollment manager, preventing connections to an unverified manager.
  • If an immediate upgrade is not possible, temporarily restrict enrollment to trusted, pre‑validated managers and block network access to unknown enrollment endpoints until the patch is applied.

Generated by OpenCVE AI on August 28, 2026 at 06:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 06:30:00 +0000

Type Values Removed Values Added
First Time appeared Wazuh
Wazuh wazuh
Vendors & Products Wazuh
Wazuh wazuh

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key response with fewer than four fields, causing a NULL pointer dereference. The  w_enrollment_process_agent_key()  routine splits the manager-provided key into four space-separated fields but does not verify that all fields are present before passing them to validators. Because OS_StrBreak() leaves missing trailing entries as NULL and OS_IsValidName() calls strlen() on its argument without a NULL check, a response such as  OSSEC K:'1'  reaches OS_IsValidName(NULL) and terminates the agent process. Since Wazuh permits enrollment against an unverified manager when no CA certificate is configured, an attacker operating a rogue manager or intercepting the enrollment flow can deterministically crash agents, resulting in denial of service. This issue is fixed in version 4.14.7.
Title Wazuh agent enrollment NULL pointer dereference via malformed manager response
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Wazuh Wazuh
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-27T23:12:20.239Z

Reserved: 2026-06-11T18:44:47.761Z

Link: CVE-2026-54084

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T00:18:07.370

Modified: 2026-08-28T00:18:07.370

Link: CVE-2026-54084

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T06:30:18Z

Weaknesses