PT-2026-60121 · Wazuh · Wazuh

Juliancnn + 1 · Published 2026-07-15 · Updated 2026-07-15 · CVE-2026-56699

Mitre

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin credentials, enabling document deletion, alert tampering, and cross-agent SIEM state manipulation.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2026-56699

Affected Products

Wazuh

References · 3

• 🔥 https://github.com/wazuh/wazuh/security/advisories/GHSA-ff9g-85jq-r3g3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-56699 · Security Note
• https://vulncheck.com/advisories/wazuh-manager-ndjson-injection-in-inventory-sync-via-agent-controlled-datavalue-index · Note