CVE-2026-39359: 
Wazuh Server vulnerability analysis and mitigation

CVE-2026-39359 is an unauthenticated path traversal vulnerability in the Wazuh Manager's enrollment daemon (authd) that allows attackers to exfiltrate sensitive configuration files. It affects Wazuh versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4. The flaw was disclosed on July 16–17, 2026, and fixed in versions 4.10.4 and 4.14.5. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). During agent enrollment, the authd daemon accepts a group name supplied by the agent and validates it by calling wopendir() on the concatenated path SHAREDCFG_DIR/<group>. Because .. resolves to the parent directory /var/ossec/etc, the directory exists and passes validation. The malicious group name (e.g., "..,default") is then stored in the manager's global database. Subsequently, the remoted daemon uses this unchecked value to construct file paths for agent configuration synchronization via copy_directory(), causing the entire contents of /var/ossec/etc — including client.keys, ossec.conf, and internal certificates — to be streamed to the attacker-controlled agent. A public PoC exploit is included in the official GitHub security advisory (GitHub Advisory).

Successful exploitation results in high confidentiality impact: an unauthenticated attacker can retrieve client.keys (containing agent encryption keys), ossec.conf (manager configuration), and internal TLS certificates from /var/ossec/etc. Because the Wazuh Manager acts as the central authority for all monitored agents, exposure of client.keys and certificates could enable an attacker to impersonate agents, intercept or tamper with agent-manager communications, and potentially compromise the integrity of the entire monitored infrastructure. There is no direct integrity or availability impact from the initial exploit, but the downstream consequences of key exposure may require full re-keying and security review (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Wazuh Manager instances running versions 4.0.0–4.10.3 or 4.11.0–4.14.4. The default enrollment port is TCP 1515 (TLS-wrapped).
2. Craft malicious enrollment payload: Prepare an OSSEC enrollment message with a path-traversal group name, e.g., OSSEC A:'pwn-agent' V:'v4.9.0' G:'..,default' IP:'src'.
3. Connect and enroll: Establish a TLS connection (accepting any certificate) to the target on port 1515 and send the crafted payload using the PoC script's pwn_enroll() function.
4. Confirm enrollment: If the manager responds with OSSEC K:, the malicious group has been accepted and stored in the global database.
5. Retrieve leaked files: The remoted daemon will synchronize the contents of /var/ossec/etc (resolved via ..) into the agent's multigroup shared cache at /var/ossec/etc/shared/multigroups/<SHA256_of_group>/. Access client.keys, ossec.conf, and certificates from this path on the enrolled agent or via the sync stream (GitHub Advisory).

• Network: Unexpected TLS connections to Wazuh Manager port 1515 from unknown or untrusted IP addresses; agent enrollment requests containing group names with .. sequences.
• Logs: Wazuh Manager ossec.log entries showing enrollment of agents with group names containing .. or .. variants (e.g., G:'..,default'); authd log entries accepting groups that resolve outside /var/ossec/etc/shared/.
• File System: Presence of unexpected files (e.g., client.keys, ossec.conf, certificates) in /var/ossec/etc/shared/multigroups/<hash>/ directories corresponding to traversal-crafted group hashes; newly created multigroup directories with SHA-256 hashes matching sha256("..,default").
• Process: remoted process performing copy_directory() operations on /var/ossec/etc rather than a subdirectory of /var/ossec/etc/shared/ (GitHub Advisory).

Wazuh has released patched versions 4.10.4 (for the 4.0.0–4.10.3 branch) and 4.14.5 (for the 4.11.0–4.14.4 branch); upgrading is the primary recommended remediation. As a network-level workaround, restrict access to the Wazuh Manager enrollment port (default TCP 1515) to trusted networks and authorized agent IP ranges only. Additionally, implement network segmentation to prevent unauthorized hosts from initiating agent enrollment. After patching, rotate client.keys and any certificates that may have been exposed (GitHub Advisory).

The vulnerability was reported by researcher Tomas Illuminati (TomasTurina) and published via the Wazuh GitHub security advisory program. No significant broader media coverage or notable social media commentary has been identified beyond standard CVE aggregator listings as of the disclosure date (GitHub Advisory).