CVE-2026-54084 in Wazuh
Summary
by MITRE • 08/28/2026
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key response with fewer than four fields, causing a NULL pointer dereference. The w_enrollment_process_agent_key() routine splits the manager-provided key into four space-separated fields but does not verify that all fields are present before passing them to validators. Because OS_StrBreak() leaves missing trailing entries as NULL and OS_IsValidName() calls strlen() on its argument without a NULL check, a response such as OSSEC K:'1' reaches OS_IsValidName(NULL) and terminates the agent process. Since Wazuh permits enrollment against an unverified manager when no CA certificate is configured, an attacker operating a rogue manager or intercepting the enrollment flow can deterministically crash agents, resulting in denial of service. This issue is fixed in version 4.14.7.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
Wazuh serves as a comprehensive open-source security platform designed to deliver unified Extended Detection and Response (XDR) and Security Information and Event Management (SIEM) capabilities for both endpoint devices and cloud workloads. Within the specific versions ranging from 4.0.0 through 4.14.6, a critical vulnerability exists in the agent enrollment mechanism that allows for remote denial of service attacks. This flaw stems from insufficient input validation during the process where an agent requests its security key from a management server. The architecture assumes that the response provided by the enrollment manager will strictly adhere to a predefined format containing exactly four space-separated fields, yet it fails to enforce this assumption programmatically before proceeding with further processing steps.
The technical root cause of this vulnerability lies in the w_enrollment_process_agent_key routine, which is responsible for parsing the key string received from the manager. This function utilizes OS_StrBreak to split the incoming data into individual components based on space delimiters. However, it does not perform a preliminary check to ensure that all expected fields are present and non-null before passing these values downstream. When an enrollment response contains fewer than four fields, such as a malformed string like OSSEC K:1 with missing trailing entries, the splitting operation results in NULL pointers for the absent components rather than empty strings or default placeholders. This behavior is characteristic of standard C library functions that return NULL when requested substrings are not found at expected positions within the source text.
The consequence of this unchecked NULL pointer propagation becomes critical during subsequent validation steps. The code proceeds to pass these potentially null values into OS_IsValidName, a function designed to verify the integrity and format of agent names or identifiers. This validator internally invokes strlen() on its input argument without first verifying that the pointer is valid. Since strlen expects a valid memory address pointing to a character string, receiving NULL triggers an immediate segmentation fault within the operating system's memory management subsystem. This results in the abrupt termination of the Wazuh agent process, effectively crashing it and removing it from active monitoring until manual intervention or restart occurs.
From an operational perspective, this vulnerability presents a significant denial of service risk to organizations relying on continuous endpoint visibility. Because Wazuh allows agents to enroll against unverified managers when no Certificate Authority certificate is configured for mutual authentication, the attack surface remains accessible to external threats. An attacker operating a rogue enrollment manager or executing a man-in-the-middle interception strategy can deliberately send malformed key responses during the initial registration phase of an agent. By doing so, they can deterministically crash any number of agents attempting to join the infrastructure, thereby creating blind spots in security monitoring and potentially disrupting incident response capabilities for affected systems.
This issue is classified under CWE-476, which denotes a NULL Pointer Dereference vulnerability, highlighting the failure to validate object references before use. In terms of tactical mapping within the MITRE ATT&CK framework, this exploit aligns with T1595.002, Active Scanning: Vulnerability Scanning, as it involves probing for weaknesses in network services, and can also be viewed through the lens of T1499.003, Endpoint Denial of Service: OS Exhaustive Flood, given its impact on system availability. The vulnerability is resolved in version 4.14.7 by implementing robust null-checks within the enrollment processing logic to ensure that all expected fields are present and valid before any string manipulation or validation functions are invoked. Administrators should prioritize upgrading their Wazuh infrastructure to this patched version immediately, while also enforcing mutual TLS authentication via CA certificates during agent enrollment to prevent unauthorized managers from initiating the vulnerable handshake process in environments where such configuration is feasible.