Description

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key response with fewer than four fields, causing a NULL pointer dereference. The  w_enrollment_process_agent_key()  routine splits the manager-provided key into four space-separated fields but does not verify that all fields are present before passing them to validators. Because OS_StrBreak() leaves missing trailing entries as NULL and OS_IsValidName() calls strlen() on its argument without a NULL check, a response such as  OSSEC K:'1'  reaches OS_IsValidName(NULL) and terminates the agent process. Since Wazuh permits enrollment against an unverified manager when no CA certificate is configured, an attacker operating a rogue manager or intercepting the enrollment flow can deterministically crash agents, resulting in denial of service. This issue is fixed in version 4.14.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-28T00:18:07.370Z",
  "pubdate": "2026-08-28T00:18:07.370Z",
  "executiveSummary": "Wazuh versions 4.0.0 through 4.14.6 are susceptible to a NULL pointer dereference vulnerability during the agent enrollment process.\nThis vulnerability is triggered when a malicious or man-in-the-middle (MITM) enrollment manager delivers a malformed key response to the agent.\nThe flaw stems from insufficient input validation in the enrollment handling logic, specifically within the parsing routine for manager-provided keys.\nSuccessful exploitation results in a deterministic crash of the Wazuh agent process, leading to a denial-of-service (DoS) condition on the endpoint.\nThe risk is elevated because the vulnerability can be exploited by an attacker operating a rogue enrollment manager or intercepting the enrollment flow, particularly when no CA certificate is configured to verify the server identity.\nThe vulnerability allows an unauthenticated attacker to disrupt security monitoring capabilities by forcing the termination of the agent service, thereby preventing the agent from reporting security events or executing remote commands.",
  "technicalDetails": "The vulnerability resides within the w_enrollment_process_agent_key() function, which is responsible for processing enrollment keys provided by the Wazuh manager during the initial handshake.\nThe root cause is an improper handling of input strings during the key-parsing phase. The routine utilizes OS_StrBreak() to tokenise the incoming key response into four space-separated fields. However, the implementation fails to validate the presence or integrity of these fields before passing them to subsequent validator functions.\nIn the event that the manager provides a malformed response—specifically a string with fewer than four expected fields—OS_StrBreak() leaves the missing trailing entries as NULL. The subsequent call to OS_IsValidName() invokes strlen() on these NULL pointers without a prior null-check, resulting in a segmentation fault and immediate agent termination.\nThe attack flow commences when an attacker, positioned either as a rogue manager or as an adversary capable of performing a MITM attack, intercept the agent enrollment request. The attacker responds with a malformed key payload, such as 'OSSEC K:'1'', which fails to populate the required indices in the parsed structure.\nBecause the Wazuh agent allows enrollment against an unverified manager in configurations where a CA certificate is not strictly enforced, the agent blindly accepts the malformed packet from the untrusted source.\nWhen w_enrollment_process_agent_key() processes this malformed input, it passes the NULL pointer resulting from the incomplete split operation into OS_IsValidName(). The call to strlen(NULL) induces a crash of the agent process, effectively disabling the endpoint's security monitoring functionality.\nThis vulnerability is present in all Wazuh versions from 4.0.0 up to and including 4.14.6. The exploitation does not require prior authentication, and the network exposure is inherent to the enrollment phase of the agent lifecycle. The impact is significant as it provides a reliable vector for silencing security agents across a fleet, potentially allowing for further exploitation of the host without alerting the centralized security operations center."
}