CVE-2026-39359

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects the Wazuh Manager's enrollment daemon (authd) and synchronization daemon (remoted). The authd process allows agents to select a group during enrollment but does not filter path traversal sequences such as "..." While the manager checks for the group directory using wopendir(), the ".." sequence references the parent directory (/var/ossec/etc), allowing it to pass validation. After the malicious group is accepted and stored in the manager's global database, the remoted process uses this unchecked value to build paths for agent configuration synchronization. As a result, sensitive files from /var/ossec/etc, such as client.keys, ossec.conf, and internal certificates, are included in the agent's shared configuration stream and exposed to the attacker. This issue has been fixed in versions 4.10.4 and 4.14.5.

• CWE-22

• https://github.com/wazuh/wazuh/security/advisories/GHSA-6q95-fcwc-4h44Exploit, Mitigation, Vendor Advisory
• https://github.com/wazuh/wazuh/security/advisories/GHSA-6q95-fcwc-4h44Exploit, Mitigation, Vendor Advisory

Published

Jul 17, 2026

Last Modified

Jul 20, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39351Frappe is a full-stack web application framework. Prior to 1…9.1
• CVE-2026-39352Frappe is a full-stack web application framework. Versions p…8.7
• CVE-2026-39354Scoold is a Q&A and a knowledge sharing platform for teams. …6.5
• CVE-2026-39355Genealogy is a family tree PHP application. Prior to 5.9.1, …8.8
• CVE-2026-39356Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.…7.5
• CVE-2026-39358CubeCart is an ecommerce software solution. Prior to 6.6.0, …7.2
• CVE-2026-3936Use after free in WebView in Google Chrome on Android prior …8.8
• CVE-2026-39360RustFS is a distributed object storage system built in Rust.…4.3
• CVE-2026-39361OpenObserve is a cloud-native observability platform. In 0.7…7.7
• CVE-2026-39362InvenTree is an Open Source Inventory Management System. Pri…7.1
• CVE-2026-39363Vite is a frontend tooling framework for JavaScript. From 6.…7.5
• CVE-2026-39364Vite is a frontend tooling framework for JavaScript. From 7.…7.5