Threats affecting pkg:github/wazuh

Wazuh versions 4.0.0 up to but not including 4.14.9 contain a SQL injection vulnerability in the WazuhDBBackend._substitute_params function. Authenticated users with agent:read permission on one agent can exploit this flaw by injecting UNION SELECT statements via the q and search parameters. This allows extraction of internal keys of all agents through a blind boolean oracle technique. The vulnerability is fixed in version 4.14.9.

Wazuh versions from 3.9.0 up to but not including 4.14.9 have a vulnerability in the fluent-forward module where TLS hostname verification is missing. This flaw allows network attackers who can redirect connections via DNS, ARP, or on-path attacks to impersonate the Fluentd collector by presenting any certificate chaining to the configured CA file. Exploiting this vulnerability enables attackers to intercept forwarded security telemetry and obtain the shared key hash for offline cracking.

Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wm_github.c) that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the GitHub API token to attacker hosts, exposing organization repositories and settings.

Wazuh versions from 3.7.0 up to but not including 4.14.9 contain a server-side request forgery (SSRF) vulnerability in the Azure wodle get_graph_events() function. This function follows the @odata.nextLink URL without validating the host or HTTPS scheme. An attacker who can influence the nextLink value may redirect requests to attacker-controlled endpoints, potentially capturing the Microsoft Graph bearer token and accessing internal services. The vulnerability has a CVSS 4.0 score of 6.3 (medium severity) and is fixed in version 4.14.9.

CVE-2026-112336 is a memory leak vulnerability in Wazuh Manager versions 3.0.0 up to but not including 4.14.9. The flaw exists in the generic JSON decoder, where repeated static fields in events can cause memory exhaustion. An attacker can exploit this by enrolling an agent without a password and sending events with duplicate fields such as 'id', leading to an out-of-memory (OOM) kill that disables alerting functionality.

A stack-based buffer overflow vulnerability exists in Wazuh agent versions from 1.0.0 up to but not including 4.14.9 in the logcollector snort-full log reader. The flaw occurs due to miscalculation of remaining buffer space in the read_snortfull() function, allowing crafted multi-line log content to overflow a 65,280-byte stack buffer. This can cause the agent to crash or overwrite the SEH handler on 32-bit Windows agents running as SYSTEM.

Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged manager-configuration attackers to corrupt root process memory via excess ar.conf entries. Attackers controlling ossec.conf active-response blocks can push over 64 commands to agents, overflowing ReadExecConfig() arrays and crashing Active Response fleet-wide.