CVE-2026-54084: Wazuh Agent DOS Vulnerability

CVE-2026-54084 Overview

CVE-2026-54084 is a NULL pointer dereference vulnerability in the Wazuh open-source security platform. The flaw affects the agent enrollment routine w_enrollment_process_agent_key() in versions 4.0.0 through 4.14.6. A malicious or man-in-the-middle enrollment manager can return a malformed key response with fewer than four space-separated fields, terminating the agent process. Because Wazuh permits enrollment against an unverified manager when no certificate authority (CA) certificate is configured, attackers can deterministically crash agents and produce a denial-of-service condition. The issue is fixed in Wazuh version 4.14.7.

Critical Impact
A rogue or intercepting enrollment manager can crash Wazuh agents on demand, disrupting endpoint telemetry and XDR/SIEM visibility during the enrollment flow.

Affected Products

Wazuh agent versions 4.0.0 through 4.14.6
Deployments where agents enroll without a configured CA certificate
Wazuh unified XDR and SIEM environments protecting endpoints and cloud workloads

Discovery Timeline

2026-08-28 - CVE-2026-54084 published to the National Vulnerability Database (NVD)
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-54084

Vulnerability Analysis

The vulnerability resides in w_enrollment_process_agent_key() within src/shared/enrollment_op.c. The routine parses the manager-provided key using OS_StrBreak(' ', keys, 4), which is expected to return four space-separated fields: ENTRY_ID, ENTRY_NAME, ENTRY_IP, and ENTRY_KEY. The function then forwards these entries directly to validators such as OS_IsValidID(), OS_IsValidName(), and OS_IsValidIP() without confirming that each field was populated.

OS_StrBreak() leaves missing trailing entries as NULL. OS_IsValidName() then calls strlen() on its argument without a NULL check. Supplying a truncated response such as OSSEC K:'1' drives OS_IsValidName(NULL), which dereferences a null pointer and terminates the agent. This condition maps to [CWE-476: NULL Pointer Dereference].

Root Cause

The root cause is missing input validation on the tokenized key array. The enrollment code trusts the structural integrity of manager-provided data. Combined with Wazuh's default behavior of permitting enrollment against an unverified manager when no CA certificate is configured, this trust boundary becomes exploitable across the network.

Attack Vector

An attacker operates a rogue enrollment manager or intercepts the enrollment flow between an agent and its legitimate manager. During enrollment, the attacker returns a malformed key response containing fewer than four space-separated fields. The agent process crashes on receipt. Repeated enrollment attempts result in sustained denial of service against endpoint telemetry collection.

// Patch from src/shared/enrollment_op.c
// fix(enrollment): verify key fields exist before validation
    *tmpstr = '\0';
    char **entries = OS_StrBreak(' ', keys, 4);
-    if (OS_IsValidID(entries[ENTRY_ID]) && OS_IsValidName(entries[ENTRY_NAME]) &&
+    if (entries && entries[ENTRY_ID] && entries[ENTRY_NAME] &&
+            entries[ENTRY_IP] && entries[ENTRY_KEY] &&
+            OS_IsValidID(entries[ENTRY_ID]) && OS_IsValidName(entries[ENTRY_NAME]) &&
            OS_IsValidIP(entries[ENTRY_IP], NULL) && OS_IsValidName(entries[ENTRY_KEY])) {
        if( !w_enrollment_store_key_entry(keys) ) {
            // Key was stored

Source: Wazuh GitHub Commit 7dfbb4a

Detection Methods for CVE-2026-54084

Indicators of Compromise

Unexpected termination of the Wazuh agent process shortly after an enrollment attempt
Enrollment traffic directed to hosts other than the configured Wazuh manager
Agent logs showing incomplete or truncated OSSEC K: responses during enrollment
Repeated agent restarts followed by immediate crashes on the same endpoint

Detection Strategies

Monitor agent process lifecycle for crashes correlated with outbound enrollment connections on TCP port 1515
Inspect network flows for enrollment sessions terminating with malformed manager responses
Alert on Wazuh agents running versions between 4.0.0 and 4.14.6 across the fleet
Detect deviations where agents contact enrollment endpoints outside the approved manager inventory

Monitoring Recommendations

Track agent connectivity and last-seen timestamps to identify fleets suddenly going offline
Log and review all enrollment attempts, including source IP and response payload length
Correlate agent restarts with network anomalies indicative of man-in-the-middle activity

How to Mitigate CVE-2026-54084

Immediate Actions Required

Upgrade all Wazuh agents to version 4.14.7 or later where the field validation fix is present
Configure a CA certificate on every agent to enforce authenticated enrollment and prevent rogue manager acceptance
Restrict enrollment traffic to trusted network segments and known manager IP addresses
Inventory agents running affected versions 4.0.0 through 4.14.6 and prioritize them for patching

Patch Information

The fix is included in Wazuh 4.14.7. The patch adds explicit NULL checks for entries, entries[ENTRY_ID], entries[ENTRY_NAME], entries[ENTRY_IP], and entries[ENTRY_KEY] before invoking any validator. Review the Wazuh Security Advisory GHSA-ppc7-hj9v-vx39 for full remediation guidance.

Workarounds

Deploy CA certificate verification on agents so enrollment fails against untrusted managers
Limit enrollment windows to controlled maintenance periods with tightened network access control lists
Use out-of-band key provisioning to avoid the network enrollment flow entirely where feasible

bash

# Enforce CA verification in ossec.conf on the agent
<client>
  <server>
    <address>MANAGER_IP</address>
    <port>1514</port>
    <protocol>tcp</protocol>
  </server>
  <enrollment>
    <enabled>yes</enabled>
    <manager_address>MANAGER_IP</manager_address>
    <port>1515</port>
    <server_ca_path>/var/ossec/etc/rootCA.pem</server_ca_path>
  </enrollment>
</client>