Path Traversal Vulnerability in Wazuh Agent Enrollment

Wazuh versions 4.0.0 through 4.14.5 are vulnerable to a path traversal flaw (CVE-2026-74038) that permits unauthenticated remote attackers to disrupt service operations. The vulnerability exists within the Wazuh enrollment process, specifically due to insufficient validation in the OS_IsValidName() function and unsafe path concatenation in the delete_diff() function.

By providing an agent name containing dot-sequence characters such as ".." during the enrollment phase over the enrollment port, an attacker can escape the intended directory structure. This triggers an unintended deletion of critical subdirectories within the queue directory. The resulting loss of required operational files forces all Wazuh services to stop, requiring manual intervention and recovery by administrators. Given the requirement for unauthenticated access to the enrollment port, this vulnerability presents a significant risk to the availability of the Wazuh management infrastructure.

Impact

Successful exploitation results in a complete denial of service of the Wazuh instance. Attackers can remotely halt all Wazuh services, requiring manual recovery efforts to restore system monitoring and logging capabilities. This vulnerability affects all Wazuh deployments prior to version 4.14.6.

Recommendation

• Upgrade all Wazuh manager instances to version 4.14.6 or later immediately to incorporate the patch for CVE-2026-74038.
• Restrict network access to the Wazuh enrollment port (default TCP/1515) to trusted network segments to prevent unauthenticated remote access.
• Review Wazuh manager logs for anomalous agent enrollment attempts containing directory traversal sequences or unexpected character sets in the agent name field.