CVE-2026-45798: 
Wazuh Server vulnerability analysis and mitigation

CVE-2026-45798 is a pre-authentication stack-based buffer overflow in Wazuh's compare_wazuh_versions() function, reachable via the wazuh-authd enrollment daemon on TCP port 1515. The vulnerability affects Wazuh versions 4.5.0 through 4.14.5 and 5.0.0-beta1, and was reported by researcher TarPeg007 and published on August 19, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is improper null termination (CWE-170) combined with a stack-based buffer overflow (CWE-121) in src/shared/version_op.c. The function compare_wazuh_versions() uses strncpy(ver2, version2, 9) to copy attacker-controlled input into a 10-byte stack buffer (char ver2[10]), but per C99 §7.21.2.4, strncpy does not NUL-terminate the destination when strlen(src) >= n. Subsequent calls to strchr(ver2, 'v') and strtok(ver2, ".") then perform unbounded reads — and a bounded write of \0 — into adjacent stack memory. The vulnerable code path is reachable pre-authentication: the V: field of an enrollment message sent over anonymous TLS to TCP/1515 is parsed by w_auth_parse_data() in auth.c, which calls compare_wazuh_versions() unconditionally when allow_higher_versions is false (the default). A minimal 38-byte trigger payload is: OSSEC A:'a' V:'AAAAAAAAA' G:'default'\n (GitHub Advisory, Fix PR).

The primary demonstrated impact is a reliable remote denial of service: a single crafted enrollment message crashes the wazuh-authd daemon, halting all new agent enrollments fleet-wide. In long-running production builds where stack memory is not zero-initialized between calls, the out-of-bounds read fires deterministically and can trigger a stack canary or access unmapped memory, causing a process crash. Secondarily, the OOB read pattern could theoretically disclose up to ~15 bytes of adjacent stack contents per read, and the strtok null-write primitive constitutes a limited write into adjacent stack memory, though no exploitation path beyond DoS has been demonstrated (GitHub Advisory).

NVD's SSVC assessment classifies this vulnerability as automatable with a PoC exploitation status, indicating proof-of-concept code is publicly available or referenced. The vulnerability requires no authentication, no user interaction, and no special configuration — anonymous TLS enrollment is enabled by default in Wazuh. The EPSS score is 0.0 at time of publication, and the vulnerability is not currently listed in the CISA KEV catalog. No threat actor attribution or in-the-wild exploitation has been reported (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Wazuh manager instances running versions 4.5.0–4.14.5 or 5.0.0-beta1 using tools like Shodan or Censys, searching for services on TCP port 1515.
2. Establish TLS connection: Connect to the target's TCP port 1515 using an SSL client (e.g., openssl s_client -connect <target>:1515 -quiet -ign_eof). No client certificate is required by default.
3. Send crafted enrollment message: Transmit a malformed enrollment message with a V: field containing exactly 9 non-null bytes with no v prefix and no . delimiter: printf "OSSEC A:'a' V:'AAAAAAAAA' G:'default'\n" | openssl s_client -connect <target>:1515 -quiet -ign_eof
4. Trigger buffer overflow: The 9-byte V: value is copied into the 10-byte ver2 stack buffer without NUL-termination, causing strchr() and strtok() to read and write beyond the buffer boundary.
5. Achieve DoS: In production builds, the OOB access triggers a stack canary violation or access to unmapped memory, crashing the wazuh-authd process and preventing all new agent enrollments (GitHub Advisory).

• Network: Repeated TCP connections to port 1515 from unexpected or external IP addresses; enrollment messages with V: fields containing exactly 9 non-null bytes and no version delimiters (no v prefix, no . separator).
• Logs: wazuh-authd crash logs or unexpected process restarts in /var/ossec/logs/ossec.log; log entries showing enrollment attempts with malformed version strings; ASan-style stack-buffer-overflow reports if debug builds are in use.
• Process: Unexpected termination or restart of the wazuh-authd process; absence of the wazuh-authd process when it should be running; new agent enrollments failing fleet-wide without configuration changes.
• File System: Core dump files generated by wazuh-authd in the working directory or system core dump location (e.g., /var/ossec/ or /tmp/) (GitHub Advisory).

Wazuh has released patched versions 4.14.6 and 5.0.0-beta2, which fix the issue by replacing the unsafe strncpy(ver2, version2, 9) call with strncpy(ver2, version2, sizeof(ver2) - 1) followed by an explicit ver2[sizeof(ver2) - 1] = '\0' to guarantee NUL-termination (Fix Commit, v4.14.6 Release, v5.0.0-beta2 Release). As a workaround for organizations unable to upgrade immediately, restricting network access to TCP port 1515 via firewall rules to only trusted agent IP ranges will prevent unauthenticated exploitation. Enabling use_password=yes in the wazuh-authd configuration adds an authentication requirement that reduces the attack surface, though upgrading to a patched version remains the recommended remediation.

The vulnerability was reported by researcher TarPeg007, who provided detailed analysis including ASan witness output, a minimal reproduction payload, and a root cause walkthrough. The Wazuh security team (developer vikman90) responded promptly, merging the fix on May 13, 2026, well before the public advisory was published on August 7, 2026 (GitHub Advisory, Fix PR). A reference to the vulnerability appeared on a threat intelligence aggregation site (ctipilot.ch) framing it as a "cluster root RCE pre-auth authd overflow," though the official advisory characterizes the demonstrated impact as DoS only.