CVE-2026-39359: Wazuh Path Traversal Vulnerability

CVE-2026-39359 Overview

CVE-2026-39359 is a path traversal vulnerability in Wazuh, an open source threat prevention, detection, and response platform. The flaw affects the Wazuh Manager's enrollment daemon (authd) and synchronization daemon (remoted) in versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4. An unauthenticated attacker enrolling as an agent can supply a group name containing .. sequences. The manager stores the malicious value and later uses it to build configuration paths, exposing sensitive files including client.keys, ossec.conf, and internal certificates.

Critical Impact
Remote attackers can retrieve sensitive files from /var/ossec/etc on the Wazuh Manager, including agent keys and internal certificates, enabling further compromise of the monitored environment.

Affected Products

Wazuh versions 4.0.0 through 4.10.3
Wazuh versions 4.11.0 through 4.14.4
Wazuh Manager authd and remoted daemons

Discovery Timeline

2026-07-17 - CVE-2026-39359 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-39359

Vulnerability Analysis

The vulnerability is a path traversal issue [CWE-22] in the Wazuh Manager enrollment workflow. During enrollment, an agent selects a group name that the authd daemon validates before accepting the agent into the manager's global database. The validation logic calls wopendir() on the constructed group directory path to confirm the group exists. The check does not filter traversal sequences such as .. from the supplied group value.

Because .. resolves to the parent directory /var/ossec/etc, the directory check succeeds and the malicious group name is persisted. The remoted daemon later reads this stored value and uses it directly when building paths for agent configuration synchronization. Sensitive files under /var/ossec/etc are then packaged into the shared configuration stream and delivered to the attacker-controlled agent.

Root Cause

The root cause is missing input sanitization in authd. The daemon relies on wopendir() to validate the group directory but never rejects traversal sequences. Because the validation confirms only that a directory exists at the resolved path, attacker-controlled values that traverse outside the intended groups directory pass validation and are stored for downstream use by remoted.

Attack Vector

Exploitation requires network access to the Wazuh Manager enrollment service and no prior authentication. The attacker initiates the standard enrollment protocol and submits a crafted group parameter containing .. traversal sequences that resolve to /var/ossec/etc. Once enrolled, the attacker connects as the agent and receives shared configuration content that includes files outside the intended group directory, disclosing client.keys, ossec.conf, and internal certificates.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-6q95-fcwc-4h44 for vendor technical details.

Detection Methods for CVE-2026-39359

Indicators of Compromise

Enrollment requests to authd containing .. or path traversal sequences in the group parameter.
Unexpected group entries in the Wazuh Manager global database referencing paths outside /var/ossec/etc/shared.
Agent configuration synchronization streams from remoted that include client.keys, ossec.conf, or files from /var/ossec/etc.

Detection Strategies

Inspect authd logs for enrollment attempts with malformed or traversal-containing group names.
Query the manager's agent inventory for group names that do not correspond to legitimate directories under /var/ossec/etc/shared.
Monitor outbound configuration payloads from remoted for the presence of key or certificate filenames.

Monitoring Recommendations

Enable verbose logging on authd and forward enrollment events to a centralized SIEM for correlation.
Alert on new agent registrations that occur outside expected onboarding windows or from unexpected source addresses.
Baseline the size and content type of agent configuration streams to flag anomalous transfers.

How to Mitigate CVE-2026-39359

Immediate Actions Required

Upgrade Wazuh Manager to version 4.10.4 or 4.14.5, which contain the vendor fix.
Rotate client.keys and any internal certificates that may have been exposed prior to patching.
Audit enrolled agents and remove entries with group names containing traversal sequences or unexpected paths.

Patch Information

The vendor has released fixed builds in Wazuh 4.10.4 and 4.14.5. Both releases add sanitization to the enrollment group parameter and reject traversal sequences before the value is persisted. Refer to the Wazuh GitHub Security Advisory for release notes and upgrade instructions.

Workarounds

Restrict network access to the enrollment service (default TCP port 1515) using firewall rules that allow only trusted onboarding hosts.
Require a pre-shared enrollment password on authd to prevent unauthenticated agent registration.
Disable automatic agent enrollment in environments where agents can be provisioned manually until the patch is applied.

bash

# Configuration example - restrict authd and require enrollment password
# /var/ossec/etc/ossec.conf on the Wazuh Manager
<auth>
  <disabled>no</disabled>
  <port>1515</port>
  <use_source_ip>no</use_source_ip>
  <force_insert>no</force_insert>
  <use_password>yes</use_password>
</auth>

# Set enrollment password
echo "$(openssl rand -hex 32)" > /var/ossec/etc/authd.pass
chmod 640 /var/ossec/etc/authd.pass
chown root:wazuh /var/ossec/etc/authd.pass

# Restrict enrollment port to trusted onboarding subnet
iptables -A INPUT -p tcp --dport 1515 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1515 -j DROP