CVE-2026-56699: Wazuh Manager RCE Vulnerability

CVE-2026-56699 Overview

CVE-2026-56699 is an NDJSON injection vulnerability in Wazuh Manager prior to version 5.0.0-beta3. The manager fails to escape the DataValue.index field when constructing OpenSearch bulk requests during inventory synchronization. Any enrolled Wazuh agent can inject arbitrary Newline Delimited JSON (NDJSON) operations into these requests. The injected operations execute under the manager's OpenSearch admin credentials, granting full write access to the SIEM data store. Attackers can smuggle delete, index, or update operations to remove alerts, tamper with detections, and manipulate SIEM state across every monitored agent. The issue is tracked as [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
A single compromised or malicious enrolled agent can delete or forge alerts across the entire Wazuh deployment, breaking the integrity of SIEM detection and audit data.

Affected Products

Wazuh Manager versions prior to 5.0.0-beta3
OpenSearch backends receiving bulk requests from vulnerable Wazuh Manager instances
Wazuh deployments using inventory synchronization with enrolled agents

Discovery Timeline

2026-07-15 - CVE-2026-56699 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-56699

Vulnerability Analysis

Wazuh Manager aggregates agent inventory data and forwards it to OpenSearch using the _bulk API. Bulk requests use the NDJSON format, where each line is a discrete JSON operation followed by an optional document body. The manager builds these requests by concatenating agent-supplied field values, including DataValue.index, without escaping embedded newline characters or JSON control tokens.

An attacker controlling an enrolled agent supplies a crafted DataValue.index value containing embedded newlines and additional JSON objects. When the manager serializes the payload, those characters terminate the intended operation and introduce new attacker-defined operations into the same bulk request. OpenSearch processes each line as a legitimate operation authenticated with the manager's administrator credentials.

Root Cause

The root cause is missing output neutralization when the manager builds bulk request bodies. The DataValue.index field is treated as opaque data but is inserted into a structured NDJSON stream without escaping. This is a classic downstream injection pattern classified as [CWE-74], where trust boundaries between agent input and backend query language are not enforced.

Attack Vector

Exploitation requires only an enrolled agent, which is the default trust posture in most Wazuh deployments. The attacker crafts inventory data whose DataValue.index field contains an NDJSON payload such as a newline followed by a {"delete":{...}} operation and a target document identifier. The manager forwards the smuggled operations to OpenSearch, where they execute with admin privileges. Consequences include:

Deletion of alerts and forensic evidence from any index
Injection of forged alerts to mislead analysts or trigger response actions
Modification of agent metadata to hide compromised hosts
Cross-agent state manipulation because the manager's credentials are not scoped per agent

Refer to the GitHub Security Advisory GHSA-ff9g-85jq-r3g3 and the VulnCheck Advisory on Wazuh Injection for full technical detail.

Detection Methods for CVE-2026-56699

Indicators of Compromise

Unexpected delete or update operations in OpenSearch audit logs originating from the Wazuh Manager service account.
Inventory sync payloads from agents containing newline characters (\n) or {"delete": / {"index": substrings inside DataValue.index fields.
Alert documents disappearing from wazuh-alerts-* indices without corresponding index lifecycle management activity.
Sudden gaps in alert timelines for specific agents, followed by inventory syncs from the same agents.

Detection Strategies

Enable OpenSearch audit logging and alert on bulk operations that affect indices outside the expected inventory index pattern.
Deploy a proxy or WAF between the Wazuh Manager and OpenSearch that validates each NDJSON line matches an allow-list of operation types and target indices.
Compare agent-side inventory hashes against manager-forwarded documents to detect tampering in transit.

Monitoring Recommendations

Monitor the ratio of delete operations to index operations issued by the manager account; a sudden increase is a strong signal.
Baseline the length and character set of DataValue.index values and flag payloads containing control characters.
Track authentication events for the OpenSearch admin credential used by the manager and alert on any use from unexpected client IPs.

How to Mitigate CVE-2026-56699

Immediate Actions Required

Upgrade Wazuh Manager to version 5.0.0-beta3 or later on every manager node in the cluster.
Rotate the OpenSearch admin credentials used by the Wazuh Manager after patching, since enrolled agents may have observed or abused them.
Audit wazuh-alerts-* and inventory indices for missing or forged documents covering the exposure window.
Review the roster of enrolled agents and revoke enrollment keys for any host that cannot be attested as trusted.

Patch Information

The fix is included in Wazuh 5.0.0-beta3. The upstream advisory is published at GHSA-ff9g-85jq-r3g3. The patch escapes newline and JSON control characters in DataValue.index before the field is embedded in bulk request bodies, restoring the boundary between agent-supplied data and the NDJSON control channel.

Workarounds

Restrict the OpenSearch role bound to the Wazuh Manager to the minimum indices required for inventory and alerting, removing cluster-wide admin privileges.
Place a reverse proxy in front of OpenSearch that rejects _bulk requests containing operations targeting indices outside an allow-list.
Temporarily disable inventory synchronization on managers that cannot be upgraded promptly, accepting the loss of inventory telemetry until patching.

bash

# Verify installed Wazuh Manager version and upgrade on Debian/Ubuntu
/var/ossec/bin/wazuh-control info | grep WAZUH_VERSION
apt-get update && apt-get install --only-upgrade wazuh-manager
systemctl restart wazuh-manager