CVE-2026-56401: Wazuh Null Pointer Dereference DoS Flaw

CVE-2026-56401 Overview

CVE-2026-56401 is a null pointer dereference vulnerability [CWE-476] in the Wazuh wazuh-modulesd component before version 5.0.0-beta3. The flaw resides in the inventory_sync FlatBuffer DataValue handling logic. An enrolled agent can send a verifier-valid DataValue message that omits the optional id field. When wazuh-modulesd calls data->id()->string_view() without null validation, the process crashes. This results in a denial-of-service condition on the Wazuh manager.

Critical Impact
An authenticated agent can crash the Wazuh manager's wazuh-modulesd daemon by sending a single crafted FlatBuffer message, disrupting security monitoring and inventory synchronization.

Affected Products

Wazuh wazuh-modulesd versions prior to 5.0.0-beta3
Wazuh manager deployments accepting inventory sync from enrolled agents
Any environment relying on Wazuh for continuous security monitoring

Discovery Timeline

2026-07-08 - CVE-2026-56401 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-56401

Vulnerability Analysis

The vulnerability affects the inventory_sync message handler in wazuh-modulesd. Wazuh uses Google FlatBuffers for serialization between agents and the manager. The DataValue schema declares id as an optional field, so its absence still passes FlatBuffer verifier checks. The manager code path assumes the field is present and directly invokes data->id()->string_view(). When id() returns nullptr, dereferencing it to call string_view() triggers a segmentation fault. The daemon terminates, interrupting inventory synchronization and dependent security workflows until the process restarts.

Root Cause

The root cause is missing null-pointer validation before dereferencing an optional FlatBuffer field. The developer treated id as mandatory in code while declaring it optional in the schema. FlatBuffer's verifier only enforces structural validity, not semantic requirements. This mismatch between schema contract and code assumptions is a common source of [CWE-476] bugs in binary protocol parsers.

Attack Vector

Exploitation requires an enrolled Wazuh agent with valid credentials. The attacker crafts a DataValue FlatBuffer message that passes verifier checks but omits the id field. Sending this message over the standard agent-manager channel causes wazuh-modulesd to dereference a null pointer and crash. No memory corruption or code execution is possible; the impact is limited to availability. Because agent enrollment is often broadly delegated, any compromised endpoint can trigger the crash. Refer to the GitHub Security Advisory GHSA-6hxp-c9x3-qc7p and the VulnCheck Advisory for additional technical detail.

No public proof-of-concept exploit code is available. The vulnerability mechanism is documented in the vendor advisory rather than through released exploit code.

Detection Methods for CVE-2026-56401

Indicators of Compromise

Unexpected termination or repeated restarts of the wazuh-modulesd process on the manager
Segmentation fault entries in /var/ossec/logs/ossec.log referencing inventory_sync or DataValue
Gaps in agent inventory data ingestion despite active agent connections
Core dumps generated by wazuh-modulesd shortly after receiving traffic from a specific agent

Detection Strategies

Monitor process lifecycle events for wazuh-modulesd and alert on abnormal exit codes
Correlate crash events with the last agent that submitted an inventory sync message
Enable FlatBuffer message logging in non-production environments to identify malformed DataValue payloads missing the id field
Baseline the frequency of inventory sync errors and flag deviations

Monitoring Recommendations

Alert when wazuh-modulesd restarts more than once within a defined interval
Track per-agent inventory sync error rates and quarantine agents that consistently trigger failures
Ingest Wazuh manager logs into a centralized SIEM to correlate manager crashes with agent activity

How to Mitigate CVE-2026-56401

Immediate Actions Required

Upgrade Wazuh to version 5.0.0-beta3 or later, which adds null validation before dereferencing the id field
Audit enrolled agents and revoke keys for any endpoints that are not trusted or no longer active
Restrict agent enrollment to controlled provisioning workflows to limit which hosts can send inventory sync messages
Enable process supervision so wazuh-modulesd automatically restarts after a crash

Patch Information

The fix is available in Wazuh 5.0.0-beta3. The vendor addressed the issue in the upstream repository; see the GitHub commit 3adf4f8 and the GitHub Security Advisory GHSA-6hxp-c9x3-qc7p for details. Administrators running pre-release 5.0.0 builds should update immediately.

Workarounds

Limit network exposure of the Wazuh manager to trusted agent networks using firewall rules
Rotate and tightly scope agent enrollment keys to reduce the population of hosts that can submit inventory_sync messages
Configure systemd or an equivalent supervisor to automatically restart wazuh-modulesd on failure as an interim availability control

bash

# Example systemd override to auto-restart wazuh-modulesd
# /etc/systemd/system/wazuh-manager.service.d/override.conf
[Service]
Restart=on-failure
RestartSec=5s