CVE-2026-45798 Overview
CVE-2026-45798 is a stack buffer vulnerability in Wazuh, an open source threat prevention, detection, and response platform. The flaw resides in the compare_wazuh_versions() function within src/shared/version_op.c. The function copies the attacker-controlled enrollment V: field into a 10-byte stack buffer with strncpy() without explicit null termination. An unauthenticated remote attacker can reach the vulnerable code path through wazuh-authd on TCP port 1515 when anonymous TLS enrollment is enabled. Sending a version string of at least nine non-null bytes causes out-of-bounds reads and adjacent stack writes, resulting in a remote denial of service. Versions 4.5.0 through 4.14.5 and 5.0.0-beta1 are affected.
Critical Impact
Unauthenticated attackers can crash the Wazuh authentication daemon over the network, disabling agent enrollment across the deployment.
Affected Products
- Wazuh 4.5.0 through 4.14.5
- Wazuh 5.0.0-beta1
- Deployments with anonymous TLS enrollment enabled on wazuh-authd (TCP/1515)
Discovery Timeline
- 2026-08-19 - CVE-2026-45798 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-45798
Vulnerability Analysis
The vulnerability sits in compare_wazuh_versions() inside src/shared/version_op.c. The function receives the V: field from an enrollment request and copies the value into a fixed 10-byte stack buffer named ver2 using strncpy(). Because strncpy() does not guarantee null termination when the source length meets or exceeds the destination size, a nine-byte or longer version string leaves ver2 without a terminator. Subsequent parsing with strchr() and strtok() then walks past the intended buffer boundary. The strtok() call also writes a null byte into adjacent stack memory when it locates a delimiter beyond ver2, corrupting nearby stack contents. This behavior is classified as a stack-based buffer error [CWE-121].
Root Cause
The root cause is unsafe use of strncpy() on attacker-controlled input without explicit termination. The buffer size is exactly matched to the copy length, so any input meeting the buffer size produces a non-terminated string. Downstream string parsing routines assume a terminator that is not present.
Attack Vector
An attacker connects to wazuh-authd on TCP port 1515 while anonymous TLS enrollment is active. The vulnerable code executes before authentication, so no credentials or agent keys are required. Sending an enrollment message with a crafted V: field of nine or more non-null bytes triggers the out-of-bounds read and adjacent stack write, crashing the daemon.
No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-4fvp-jfc3-qr6r and the fix commit for the exact code path.
Detection Methods for CVE-2026-45798
Indicators of Compromise
- Unexpected termination or repeated restarts of the wazuh-authd process on the Wazuh manager
- Inbound TCP/1515 connections from unknown or unauthorized sources when anonymous enrollment is enabled
- Enrollment requests containing malformed or oversized V: version fields in wazuh-authd logs
Detection Strategies
- Monitor wazuh-authd process health and correlate crashes with recent inbound connections on port 1515
- Inspect enrollment traffic for version fields longer than eight bytes or containing non-standard characters
- Alert on any anonymous enrollment attempts when the deployment policy requires pre-shared keys or certificate authentication
Monitoring Recommendations
- Forward ossec.log and authd logs to a central logging platform and alert on repeated daemon restarts
- Track connection volume to TCP/1515 and baseline normal enrollment patterns
- Review firewall telemetry to confirm that only authorized subnets can reach the enrollment port
How to Mitigate CVE-2026-45798
Immediate Actions Required
- Upgrade Wazuh manager installations to version 4.14.6 or 5.0.0-beta2
- Disable anonymous TLS enrollment on wazuh-authd until the upgrade is complete
- Restrict inbound access to TCP/1515 to trusted management networks only
- Rotate any authentication material used with wazuh-authd after patching
Patch Information
The issue is fixed in Wazuh 4.14.6 and Wazuh 5.0.0-beta2. The corrective change is tracked in pull request #36059 and merged as commit b6aac37, which ensures the ver2 buffer is properly terminated before parsing.
Workarounds
- Require pre-shared keys or client certificates for agent enrollment instead of anonymous TLS
- Firewall TCP/1515 so only authorized provisioning hosts can reach the enrollment service
- Temporarily stop wazuh-authd during periods when new agent enrollment is not required
# Restrict TCP/1515 to a trusted management subnet with iptables
iptables -A INPUT -p tcp --dport 1515 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1515 -j DROP
# Disable anonymous enrollment by requiring a password in /var/ossec/etc/authd.pass
echo "REPLACE_WITH_STRONG_SECRET" > /var/ossec/etc/authd.pass
chmod 640 /var/ossec/etc/authd.pass
systemctl restart wazuh-manager
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
