75 matches found
CVE-2025-24016
Wazuh Ejecución Remota de Código RCE - PoC Resumen de la Vulnerabilidad Este repositorio demuestra la vulnerabilidad de ejecución remota de código RCE en el servidor Wazuh, introducida por una deserialización insegura en el paquete wazuh-manager. La vulnerabilidad permite a atacantes remotos con...
CVE-2026-104874 vulnerabilities
Vulnerabilities for packages: authentik, authentik-fips, puppygraph-python, mlflow-fips, wazuh-manager, crossplane-function-pythonic...
GHSA-54P9-H82J-F925 vulnerabilities
Vulnerabilities for packages: authentik, authentik-fips, puppygraph-python, mlflow-fips, wazuh-manager, crossplane-function-pythonic...
CVE-2021-26814
CVE-2021-26814 Un PoC simple en Python para explotar CVE-2021-26814 y obtener RCE en Wazuh Manager v.4.0.0-4.0.3 a través del servicio API. Para ejecutarlo, simplemente haga ejecutable el script .py y láncelo con los parámetros requeridos. PoC.py -h -user USERNAME -pwd PASSWORD -lip SRCIP -lport...
CVE-2025-24016
Ejecución Remota de Código RCE en Wazuh - PoC Resumen de la Vulnerabilidad Este repositorio demuestra la vulnerabilidad de ejecución remota de código RCE en el servidor Wazuh, introducida por una deserialización insegura en el paquete wazuh-manager. La vulnerabilidad permite que atacantes remotos...
CVE-2025-24016-Wazuh-Remote-Code-Execution-RCE-PoC
🚨 Wazuh 远程代码执行 RCE - PoC 📌 漏洞摘要 在 Wazuh 服务器中发现了一个严重的 RCE 漏洞，原因是 wazuh-manager 包中存在不安全的反序列化。此漏洞影响 Wazuh 版本 ≥ 4.4.0，并在 4.9.1 版本中修复。 🔍 详情 该缺陷位于 Wazuh API 的 DistributedAPI 中，其中用户控制的输入被不安全地反序列化。这使得拥有API访问权限的攻击者（例如，受感染的仪表板或集群节点）能够通过 runas 端点在主服务器上执行任意 Python 代码。 📬 概念验证 Burp 请求 POST...
CVE-2021-26814
CVE-2021-26814 一个简单的Python PoC，用于利用CVE-2021-26814 并通过API服务在Wazuh Manager （v.4.0.0-4.0.3）上获得RCE。 运行它，只需将.py脚本设置为可执行，并使用所需参数启动它。 PoC.py -h -user USERNAME -pwd PASSWORD -lip SRCIP -lport SRCPORT -tip DESTIP -tport DESTPORT 警告 ：管理器上的wazuh-apid.py文件将被更改！ 为了在漏洞利用完成后恢复原始版本，会创建一个名为backup.py的本地文件。 作者 Davi...
CVE-Wazuh
Wazuh Manager — Inyección NDJSON en inventorysync mediante DataValue.index controlado por el agente - Borrador Un agente registrado puede introducir operaciones bulk arbitrarias de OpenSearch mediante DataValue.index. GHSA-ff9g-85jq-r3g3 ⚡ Uso Rápido Usa este proyecto solo en entornos seguros y...
CVE-2026-71540 Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framework/wazuh/core/cluster/common.py allocates a payload buffer using the size declared in a 20-byte cluster protocol header before...
The vulnerability of the Wazuh Manager component of the security monitoring and threat detection platform Wazuh allows attackers to gain unauthorized access to protected information and increase their privileges.
The vulnerability of the Wazuh Manager component of the security monitoring and threat detection platform Wazuh is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information a...
CVE-2026-48162 Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.sendtmpfile in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmpfile value to WAZUHPATH without canonicalization or...
CVE-2026-44252 Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET...
CVE-2026-44252 Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET...
CVE-2026-44252 Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET...
PT-2026-70992
Name of the Vulnerable Software and Affected Versions Wazuh Manager affected versions not specified Description A deserialization of untrusted data issue exists in the Cluster DAPI Protocol, which allows a remote attacker to execute arbitrary code and perform arbitrary file read and write...
The vulnerability of the inventory_sync() function in the Wazuh Manager’s cluster synchronization component allows a perpetrator to execute arbitrary code. This vulnerability exists in the monitoring and threat detection tools provided by Wazuh.
The vulnerability of the inventorysync function in the Wazuh Manager’s cluster synchronization component, a platform for security monitoring and threat detection, is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability could allow an attacker...
CVE-2026-56699
The Wazuh Manager is vulnerable to NDJSON Injection in the inventory_sync() function within the cluster synchronization component. This occurs because the software fails to escape the DataValue.index field when constructing OpenSearch bulk requests. An attacker operating remotely can leverage thi...
CVE-2026-56699 Wazuh Manager - NDJSON Injection in inventory_sync via Agent-Controlled DataValue.index
Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin...
EUVD-2026-44630
Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin...