Skip to content
OpenAdvisories
High WID-SEC-2026-4377 8 CVEs

Wazuh: Mehrere Schwachstellen

Published Nov 5, 2026 · Updated Nov 8, 2026 · Revision 2 · de

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Wazuh ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Informationen auszuspähen, Daten zu manipulieren, beliebigen Programmcode mit Administratorrechten auszuführen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Wazuh ist eine Sicherheitsüberwachungsplattform, die Funktionen wie Intrusion Detection, Log-Analyse und Sicherheitsinformations- und Ereignismanagement (SIEM) bietet.

Vulnerabilities 8

  • High 8.2
    CVE-2026-112340

    Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request

    Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.hea…

    wazuh wazuh-dashboard-plugins
  • Medium 6.5
    CVE-2026-112336

    Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder

    Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through passwordless enrollment an…

    wazuh wazuh
  • Medium 6.5
    CVE-2026-112341

    Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params

    Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend._substitute_params due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and …

    wazuh wazuh
  • Medium 5.9
    CVE-2026-112338

    Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination

    Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wm_github.c) that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the…

    wazuh wazuh
  • Medium 5.9
    CVE-2026-112339

    Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module

    Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wm_fluent_ssl_ctx() that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the confi…

    wazuh wazuh
  • Medium 5.5
    CVE-2026-112335

    Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull

    Wazuh agent from 1.0.0 before 4.14.9 contains a stack-based buffer overflow in the logcollector snort-full log reader that miscalculates remaining buffer space in read_snortfull(). Attackers who write crafted multi-line content to a monitored snort-full log c…

    wazuh wazuh
  • Medium 4.9
    CVE-2026-112334

    Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf

    Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged manager-configuration attackers to corrupt root process memory via excess ar.conf entries. Attackers controlling ossec.conf active-response bloc…

    wazuh wazuh
  • Low 3.7
    CVE-2026-112337

    Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination

    Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_graph_events() function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager r…

    wazuh wazuh

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-118284, EUVD-2026-118283, EUVD-2026-118282, EUVD-2026-118281, EUVD-2026-118279, EUVD-2026-118278, EUVD-2026-118277, EUVD-2026-118280

  2. #1

    Initiale Fassung

References