CVE-2026-56699: Wazuh Manager NDJSON Injection Vulnerability
TL;DR - Critical CVSS 10.0 flaw in Wazuh Manager before 5.0.0-beta3. - A malicious enrolled agent can inject OpenSearch bulk actions using manager admin credentials. - Upgrade to 5.0.0-beta3 or later and audit OpenSearch data integrity immediately.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-56699 |
| CVSS | 10.0 (Critical) |
| Attack vector | Network via enrolled Wazuh agent input to Wazuh Manager |
| Privileges required | None on the manager itself, but attacker must control a malicious or compromised enrolled agent |
| Patch available | Yes, fixed in 5.0.0-beta3 |
CVE-2026-56699 is a trust-boundary failure in Wazuh Manager’s handling of inventory synchronization data sent by agents. According to the NVD description, the manager fails to properly escape the agent-controlled DataValue.index field before building OpenSearch bulk NDJSON requests. That lets a malicious agent inject additional bulk operations into requests that the manager sends with privileged OpenSearch credentials.
From a defender’s perspective, the key issue is not just code execution of an unexpected operation. It is data integrity compromise inside the SIEM backend. Because the injected operations can include delete, index, or update, this flaw can enable alert tampering, document deletion, and cross-agent manipulation of stored security telemetry. Even if no public in-the-wild exploitation is confirmed yet, the blast radius is high enough to treat vulnerable deployments as an urgent remediation priority.
What Is This Vulnerability?
The root cause is improper neutralization of agent-controlled input during construction of OpenSearch bulk requests. OpenSearch bulk APIs use NDJSON, where each action and document is represented as newline-delimited JSON records. If an application inserts untrusted input into that stream without safe escaping or structural validation, an attacker can break out of the intended data element and add new operations.
In this case, Wazuh Manager uses the DataValue.index field, which is controlled by the enrolled agent, while building bulk requests for inventory synchronization. Per NVD, that field is not properly escaped before being embedded in NDJSON. A malicious agent can therefore craft input that causes the bulk stream to contain attacker-chosen delete, index, or update actions, rather than only the manager’s intended operation.
The important technical boundary here is privilege separation. The attacker does not need OpenSearch admin credentials directly. Instead, they abuse Wazuh Manager as a privileged deputy. The manager submits the malformed bulk request under its own administrative OpenSearch credentials, so the injected actions inherit that authority.
Technical Notes
A simplified conceptual example of a normal OpenSearch bulk payload looks like this:
{ "index": { "_index": "wazuh-inventory", "_id": "agent-123" } }
{ "hostname": "host1", "os": "linux" }
If untrusted input is inserted into the wrong place without escaping, an attacker may be able to force extra NDJSON operations into the stream:
{ "index": { "_index": "wazuh-inventory" } }
{ "hostname": "host1" }
{ "delete": { "_index": "wazuh-alerts-*", "_id": "abc123" } }
{ "index": { "_index": "wazuh-alerts-4.x-2026.07.15", "_id": "forged" } }
{ "rule": { "level": 0 }, "message": "tampered" }
The exact exploit string and payload format may vary, and defenders should not assume only one index pattern or one operation type. The reliable takeaway is that agent-supplied values can alter the structure of a privileged bulk request.
Who Is Affected?
The affected product is Wazuh Manager, and the affected version range is before 5.0.0-beta3. The fixed version identified by NVD is 5.0.0-beta3. Based on the available primary-source-backed data, defenders should treat any Wazuh Manager release earlier than 5.0.0-beta3 as vulnerable unless vendor guidance explicitly says otherwise.
That means the minimum confirmed remediation point is upgrade to 5.0.0-beta3 or later. The research context also notes secondary reporting around the 5.0 beta line, including discussion of 5.0.0-beta1, but the strongest source-backed statement remains the NVD wording: “before 5.0.0-beta3.” For production decision-making, use that range rather than extrapolating unsupported version lists.
This issue primarily matters in environments where Wazuh agents are broadly enrolled and where OpenSearch data supports detection, incident response, compliance, or forensics. If an attacker compromises one endpoint with an enrolled agent or can register a malicious agent in a weakly controlled environment, they may be able to pivot into the integrity of centralized SIEM records.
Technical Notes
To verify the installed Wazuh Manager version, check package metadata or service files on the manager node:
dpkg -l | grep wazuh
rpm -qa | grep wazuh
/var/ossec/bin/wazuh-control info
If your environment uses containers, verify the image tag and deployment manifest rather than relying on memory or documentation:
docker ps --format '{{.Image}} {{.Names}}' | grep wazuh
CVSS Score Breakdown
NVD assigns CVSS v3.x 10.0, which places this issue in the critical category. Even without every vector component reproduced here from a vendor advisory, the score aligns with the described impact: a network-reachable trust-boundary flaw that enables high-impact manipulation of backend security data through a privileged service.
The likely severity drivers are straightforward. Attack complexity appears low once an attacker controls an enrolled agent and understands the vulnerable field. The impact spans integrity in a major way, and availability may also be affected if bulk-injected delete or destructive updates target operational indexes. Confidentiality impact is less explicitly described in the available data, but the integrity compromise alone is enough to make this a serious incident-response concern because defenders may no longer trust the SIEM record.
For practitioners, the most useful reading of the score is practical rather than academic: this is not just an agent-local issue. It can undermine central telemetry and alert history, which can blind analysts, corrupt investigations, or erase evidence. A critical score is justified because the vulnerability turns a lower-trust component, the agent, into a way to alter higher-trust backend state.
Exploitation Status
At the time of writing, CISA KEV does not list CVE-2026-56699, so there is no confirmed CISA-tracked exploitation in the wild. That does not mean the vulnerability is safe to defer. KEV absence only means CISA has not added it to the catalog. Defenders should still assume exploit development is plausible because the vulnerable field and the impact path are publicly described.
As for public exploit material, the NVD record references a GitHub Security Advisory and a VulnCheck advisory, which provide public technical details. Based on the research note, there is no verified standalone public PoC repository confirmed from the provided sources. So the most accurate statement is: public technical details exist; a public PoC repository was not verified from the cited reference set; active exploitation is not confirmed.
This distinction matters operationally. If exploitation is not confirmed, you still patch because the impact is severe and the exploit concept is direct. If a malicious or compromised agent exists in your environment, the barrier to abuse may be much lower than for a typical unauthenticated internet-facing vulnerability.
Technical Notes
Defenders should also check whether internal red teams, researchers, or adversaries could weaponize the issue from the advisory description alone. In practical terms, treat any suspicious agent behavior near the publication date as potentially related, even if no public exploit release is known.
How to Detect It
Detection should focus on two planes: suspicious agent-originated inventory activity on the Wazuh side, and abnormal OpenSearch bulk operations on the backend. Because the exploit works by inserting additional NDJSON operations into bulk requests, defenders should review OpenSearch audit logs, reverse proxy logs, and Wazuh manager logs for unexpected bulk writes, deletes, or updates tied to manager-originated credentials.
You should also investigate sudden deletion of documents, unexplained updates across multiple agents, or alert records that appear inconsistent with upstream endpoint reality. A key sign of abuse would be a manager account issuing bulk actions against indexes or document IDs unrelated to the reporting agent’s expected inventory synchronization path.
Technical Notes
If OpenSearch audit logging is enabled, look for manager-authenticated bulk requests followed by unexpected operations or index targets. Example grep patterns:
grep -E '"_bulk"|delete|update|index' /var/log/opensearch/* 2>/dev/null
Look for suspicious requests originating from the Wazuh Manager host:
grep -E 'POST .*_bulk' /var/log/nginx/access.log /var/log/httpd/*access* 2>/dev/null
A simple Splunk search for suspicious bulk activity from the manager IP might look like:
index=opensearch_logs ("_bulk" AND ("delete" OR "update" OR "index"))
| stats count by src_ip, user, uri_path, http_status
Example Elastic query logic for audit events:
{
"query": {
"bool": {
"must": [
{ "match": { "request.method": "POST" } },
{ "match": { "url.path": "/_bulk" } }
],
"filter": [
{ "term": { "source.ip": "WAZUH_MANAGER_IP" } }
]
}
}
}
Also hunt for anomalies in index modification volume:
curl -s -u admin:REDACTED https://opensearch.example:9200/_cat/indices?v
If you do not have OpenSearch audit logs enabled, assume reduced visibility and prioritize patching plus integrity review of recent SIEM data. In the absence of strong telemetry, compare recent alert and inventory records against endpoint-local logs for spot validation.
Mitigation and Patching
The primary fix is to upgrade Wazuh Manager to 5.0.0-beta3 or later. The affected range is before 5.0.0-beta3, and that fixed version is the strongest confirmed remediation point from the available source set. If you are running a pre-release or test environment on an earlier 5.0 beta build, patching should still be treated as urgent because beta deployments often back important monitoring environments.
If immediate upgrading is not possible, the best temporary mitigation is to reduce trust in enrolled agents and constrain the manager’s ability to submit privileged OpenSearch operations. That can include isolating or removing untrusted agents, limiting agent enrollment to tightly controlled assets, and reviewing whether the manager’s OpenSearch permissions are broader than required. However, these are compensating controls only. They do not remove the vulnerable request construction path.
You should also perform a post-patch integrity review. Because the impact includes deletion and tampering, patching alone does not guarantee your stored data is trustworthy. Review recent OpenSearch changes, alert histories, and inventory records for unexplained gaps or cross-agent inconsistencies.
Technical Notes
Example upgrade workflow on Debian-based systems:
sudo apt update
sudo apt install wazuh-manager=5.0.0-beta3
sudo systemctl restart wazuh-manager
Example upgrade workflow on RHEL-based systems:
sudo yum install wazuh-manager-5.0.0-beta3
sudo systemctl restart wazuh-manager
If your repository naming differs, use your package manager to list the exact available build:
apt-cache madison wazuh-manager
yum --showduplicates list wazuh-manager
As a temporary workaround while planning an upgrade, remove or isolate suspicious agents and monitor manager-to-OpenSearch traffic closely. For example, restrict manager egress to only approved OpenSearch endpoints and alert on unexpected _bulk spikes. If your deployment permits role-based restrictions in OpenSearch, review whether the manager account can be narrowed from broad administrative rights, understanding that this may affect functionality and must be tested carefully.
References
The primary public reference is the NVD entry for CVE-2026-56699, which states that Wazuh Manager before 5.0.0-beta3 fails to escape the agent-controlled DataValue.index field when constructing OpenSearch bulk requests. That description is the strongest source for affected versions, impact, and the fixed version threshold used in this article.
The GitHub Security Advisory and VulnCheck advisory provide supporting context for defenders tracking public discussion and remediation. CISA KEV is also relevant to exploitation status because the CVE is not currently listed there. As always, if Wazuh publishes additional technical details, upgrade guidance, or backport information later, defenders should reconcile local remediation plans against that vendor guidance.
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56699
- GitHub Security Advisory: https://github.com/wazuh/wazuh/security/advisories/GHSA-ff9g-85jq-r3g3
- VulnCheck Advisory: https://www.vulncheck.com/advisories/wazuh-manager-ndjson-injection-in-inventory-sync-via-agent-controlled-datavalue-index
- CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
For further understanding of related vulnerabilities, refer to our articles on what is a passkey and what is a supply chain attack.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.