CVE-2026-67308

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

CVE-2026-67307

Wazuh 5.0.0-beta1 fixed in 5.0.0-beta3 does not validate or override the clustername and clusternode fields in inventory-sync Start FlatBuffer messages, while validating only the agentid against the authenticated agent identity. This allows a low-privileged enrolled agent to spoof cluster...

CVE-2026-67307

Wazuh 5.0.0-beta1 is affected by a vulnerability in inventory-sync Start FlatBuffer messages where cluster_name and cluster_node are not validated or overridden, while agentid is validated. This enables a low-privileged enrolled agent to spoof cluster attribution in indexed inventory and vulnerab...

CVE-2026-67307 Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync

Wazuh 5.0.0-beta1 fixed in 5.0.0-beta3 does not validate or override the clustername and clusternode fields in inventory-sync Start FlatBuffer messages, while validating only the agentid against the authenticated agent identity. This allows a low-privileged enrolled agent to spoof cluster...

EUVD-2026-51833

Wazuh 5.0.0-beta1 fixed in 5.0.0-beta3 does not validate or override the clustername and clusternode fields in inventory-sync Start FlatBuffer messages, while validating only the agentid against the authenticated agent identity. This allows a low-privileged enrolled agent to spoof cluster...

CVE-2026-67308

Concretely documented CVE-2026-67308 affects Wazuh workflows prior to 44bf114. A shell injection exists in GitHub Actions workflows via fork pull requests that submit crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated in...

EUVD-2026-51853

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

CVE-2026-67308 Wazuh GitHub Actions Shell Injection via Fork Pull Request

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

CVE-2026-67308

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

CVE-2026-65913 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard...

CVE-2026-65914 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard...

CVE-2026-65912 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard...

CVE-2026-65899 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, opensearch-dashboards, kibana, langfuse-fips, librechat, wazuh-dashboard-fips, langfuse, nextcloud-server...

CVE-2026-65901 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, kibana, langfuse-fips, librechat, wazuh-dashboard-fips, langfuse, nextcloud-server...

CVE-2026-65900 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, kibana, langfuse-fips, librechat, wazuh-dashboard-fips, langfuse, nextcloud-server...

CVE-2026-65903 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, opensearch-dashboards, kibana, langfuse-fips, librechat, opensearch-dashboards-fips, wazuh-dashboard-fips, langfuse, nextcloud-server...

CVE-2026-65898 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, opensearch-dashboards, kibana, langfuse-fips, librechat, opensearch-dashboards-fips, wazuh-dashboard-fips, langfuse, nextcloud-server...

CVE-2026-65902 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, kibana, langfuse-fips, librechat, wazuh-dashboard-fips, langfuse, nextcloud-server...

Wazuh - Unsafe Deserialization Remote Code Execution

A critical Remote Code Execution RCE vulnerability exists in Wazuh server versions = 4.4.0 and = 4.4.0 and 4.9.1. The vulnerability occurs due to unsafe deserialization in the wazuh-manager package, specifically in the DistributedAPI where parameters are serialized as JSON and deserialized using...

CVE-2026-28220 Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API DAPI handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the maste...