CVE-2026-67307 Overview
CVE-2026-67307 affects Wazuh 5.0.0-beta1 and is fixed in 5.0.0-beta3. The vulnerability exists in the inventory-sync FlatBuffer message handler. Wazuh validates the agentid field against the authenticated agent identity but does not validate or override the cluster_name and cluster_node fields. A low-privileged enrolled agent can forge wazuh.cluster.name values and influence the document _id prefix in indexed inventory and vulnerability records. This weakness is categorized under CWE-345: Insufficient Verification of Data Authenticity.
Critical Impact
A compromised or malicious agent can tamper with inventory records and, in shared-indexer multi-cluster deployments where numeric agent IDs collide, poison another cluster's records.
Affected Products
- Wazuh 5.0.0-beta1
- Wazuh server components handling inventory-sync FlatBuffer messages
- Shared-indexer multi-cluster Wazuh deployments
Discovery Timeline
- 2026-08-01 - CVE-2026-67307 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67307
Vulnerability Analysis
Wazuh uses FlatBuffer messages for the inventory-sync protocol between agents and the manager. The Start message includes fields identifying the agent (agentid) and the cluster context (cluster_name, cluster_node). The server-side handler authenticates the agent and confirms that the supplied agentid matches the enrolled identity. However, the handler trusts the cluster_name and cluster_node values without validating them against the manager's actual cluster membership. Downstream indexing logic then uses these fields to compose the wazuh.cluster.name document attribute and to prefix the document _id used in the indexer. Since an agent controls both fields, it can attribute its inventory and vulnerability documents to arbitrary clusters or nodes.
Root Cause
The root cause is missing server-side validation and override of client-supplied cluster metadata. The server should ignore or overwrite the cluster_name and cluster_node fields with values derived from the authenticated manager context. Instead, it accepts agent-supplied values verbatim. The fix in commit b3dae02ec9ddcfd449cb61b4c76d180e3e43f79a enforces cluster attribution on the server side rather than trusting the FlatBuffer payload.
Attack Vector
An attacker requires a valid enrollment key or control over an already-enrolled low-privileged agent. From that position, the attacker crafts inventory-sync Start FlatBuffer messages containing forged cluster_name and cluster_node values. When multiple Wazuh clusters share an indexer backend, an attacker can select a target cluster's name and, if a numeric agent ID collision exists, overwrite the legitimate target agent's inventory and vulnerability documents. The attack does not require network position beyond normal agent-to-manager connectivity, but exploitation complexity is elevated because it depends on knowledge of the target cluster's naming scheme and agent ID collisions.
No verified proof-of-concept code is publicly available. Refer to the GitHub Security Advisory GHSA-jv5p-fhwh-9w55 and the VulnCheck Advisory for authoritative technical detail.
Detection Methods for CVE-2026-67307
Indicators of Compromise
- Inventory or vulnerability documents in the indexer with wazuh.cluster.name values that do not match any manager in the deployment.
- Document _id prefixes referencing cluster names or nodes that are unexpected for the reporting agent.
- Sudden divergence between an agent's historical cluster attribution and newly indexed records.
Detection Strategies
- Query the Wazuh indexer for distinct wazuh.cluster.name values and alert on any value outside the known cluster inventory.
- Correlate agentid with expected cluster_name mappings and flag mismatches on ingest.
- In shared-indexer deployments, monitor for document overwrites where the writing manager's cluster identity does not match the indexed wazuh.cluster.name.
Monitoring Recommendations
- Enable audit logging on the Wazuh manager for inventory-sync Start messages and retain FlatBuffer field values for forensic review.
- Track vulnerability document churn per agent to detect unexpected rewrites originating from other clusters.
- Alert on new or unknown cluster_node identifiers appearing in indexed telemetry.
How to Mitigate CVE-2026-67307
Immediate Actions Required
- Upgrade Wazuh to 5.0.0-beta3 or later, which contains the server-side enforcement fix.
- Audit shared-indexer deployments for numeric agent ID collisions across clusters and renumber where collisions exist.
- Review indexed inventory and vulnerability documents for anomalous wazuh.cluster.name values and purge tampered records.
Patch Information
The fix is delivered in Wazuh 5.0.0-beta3 via commit b3dae02ec9ddcfd449cb61b4c76d180e3e43f79a. The patch ensures the server overrides cluster_name and cluster_node in inventory-sync messages using authenticated manager context. Details are documented in the GitHub Security Advisory GHSA-jv5p-fhwh-9w55.
Workarounds
- Where upgrade is not immediately feasible, isolate clusters onto dedicated indexers to eliminate cross-cluster document poisoning.
- Enforce unique numeric agent IDs across all clusters sharing an indexer to remove the _id collision precondition.
- Restrict agent enrollment and rotate enrollment keys to reduce the population of agents capable of sending forged inventory-sync messages.
# Verify installed Wazuh version and upgrade path
/var/ossec/bin/wazuh-control info
apt-get update && apt-get install --only-upgrade wazuh-manager=5.0.0-beta3-1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
