CVE-2026-56699 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-56699 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-56699 is a critical, CVSS 10 flaw in Wazuh Manager before 5.0.0-beta3. The issue is an NDJSON injection bug in OpenSearch bulk request construction: the manager fails to escape the DataValue.index field, allowing a enrolled agent to smuggle arbitrary bulk operations. In practice, an attacker who can control agent-supplied data may inject delete, index, or update actions into requests executed with manager admin credentials.

That means this is not just a parsing bug. It can lead to document deletion, alert tampering, and cross-agent SIEM state manipulation. Even though there is no known exploitation in the wild and it is not in CISA KEV, the impact is severe enough to treat as an emergency.

Immediate Action

  • Patch immediately to Wazuh Manager 5.0.0-beta3 or later. If you cannot patch today, isolate the manager from untrusted agent input and restrict agent enrollment.
  • Disable or pause agent enrollment until the fix is deployed. Treat any newly enrolled or untrusted agent as a potential injection source.
  • Limit manager-to-OpenSearch privileges to the minimum required. If possible, rotate the credentials used by the manager after upgrading.
  • Review recent alerts and index activity for unexpected deletes, updates, or bulk request anomalies. Look for missing alerts or sudden changes in SIEM data.
  • Rollback guidance: if you must roll back, roll back only to a known-good, isolated environment and keep the affected manager offline until patched. Do not continue running the vulnerable version in production.
  • Vendor advisory: see the Wazuh security advisory and CVE record for the latest fix notes.

Affected Versions

  • wazuh-manager < 5.0.0-beta3 vulnerable
  • wazuh-manager 5.0.0-beta3+ safe, pending vendor confirmation
  • Wazuh Manager 4.x and earlier: vulnerable unless the vendor states otherwise
  • Wazuh Manager 5.0.0-beta3 or newer: upgrade target

Note: if your deployment uses a packaged image or appliance, verify the embedded manager version rather than assuming the tag is safe.

Resolution Guide

Preferred fix: upgrade Wazuh Manager to the first non-vulnerable release. If your environment uses containers or package managers, update the manager package/image and restart the service.

# Linux package installs: replace with your distro/package name if different
sudo apt-get update
sudo apt-get install --only-upgrade wazuh-manager
# or
sudo yum update wazuh-manager

# If a specific fixed version is known, pin it:
sudo apt-get install wazuh-manager=5.0.0-beta3

# Docker
docker pull wazuh/wazuh-manager:5.0.0-beta3
docker stop wazuh-manager
docker rm wazuh-manager
docker run -d --name wazuh-manager wazuh/wazuh-manager:5.0.0-beta3

# Java ecosystem only if you embed Wazuh-related client code or wrappers
# Maven
mvn versions:use-latest-releases

# Gradle
./gradlew dependencyUpdates

# Python ecosystem only if you have automation around Wazuh management
pip install --upgrade wazuh
pipx upgrade wazuh

# JavaScript ecosystem only if you use a wrapper or admin tooling
npm i wazuh@latest
yarn add wazuh@latest
pnpm add wazuh@latest

Config hardening: until patched, reduce exposure by limiting agent enrollment, isolating the manager network, and restricting OpenSearch permissions.

# Example hardening ideas
# - block new agent enrollment at the network edge
# - allow manager access only from trusted admin hosts
# - rotate OpenSearch credentials after upgrade
# - disable any custom automation that writes agent-controlled fields into bulk requests

Minimal code fix example: escape or reject unsafe NDJSON content before composing bulk operations. If you maintain a fork or plugin, ensure DataValue.index is treated as untrusted input.

// Pseudocode patch: reject newline and control characters
function sanitizeIndex(value) {
  if (/[\r\n]/.test(value)) {
    throw new Error("Invalid index value");
  }
  return value.replace(/"/g, '\\"');
}

Detection & Verification

Check your version first. If the manager reports anything below 5.0.0-beta3, assume vulnerable.

# Check package version
wazuh-manager -V 2>/dev/null || wazuh-control info 2>/dev/null

# Debian/Ubuntu
dpkg -l | grep wazuh-manager

# RHEL/CentOS/Rocky
rpm -q wazuh-manager

# Docker image tag
docker inspect --format='{{.Config.Image}}' wazuh-manager

Search for risky request construction in custom scripts, plugins, or forks that may pass agent-controlled values into bulk NDJSON.

# Grep for bulk request builders or index handling
grep -RIn "bulk\|NDJSON\|DataValue.index\|opensearch" /var/ossec /opt/wazuh 2>/dev/null

Verify the fix by confirming the upgraded version and testing that newline-bearing input is rejected or escaped. Also review OpenSearch logs for unexpected bulk actions after the upgrade.

# Confirm service is running the fixed version
systemctl status wazuh-manager
journalctl -u wazuh-manager --since "24 hours ago" | tail -200

# Check for suspicious bulk operations in OpenSearch logs
grep -RIn "delete\|update\|bulk" /var/log/opensearch /var/log/wazuh 2>/dev/null

Risk and Impact

This flaw can let a malicious or compromised agent inject extra OpenSearch operations into manager-executed bulk requests. The result can be silent deletion of records, tampering with alerts, and corruption of SIEM state across multiple agents. Because the manager runs these actions with admin credentials, the blast radius can extend to the full Wazuh/OpenSearch data plane, not just one endpoint.

For solo developers and small teams, the practical risk is loss of trust in your security telemetry: once alerts or indices are altered, incident response becomes unreliable. Patch first, then validate data integrity before resuming normal monitoring.

Keep reading