https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 15:01:14 +0000 https://vulnerability.circl.lu/vuln/cve-2026-39359 <p><strong>Affected:</strong> wazuh</p> <p>Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects the Wazuh Manager&#39;s enrollment daemon (authd) and synchronization daemon (remoted). The authd process allows agents to select a group during enrollment but does not filter path traversal sequences such as &#34;...&#34; While the manager checks for the group directory using wopendir(), the &#34;..&#34; sequence references the parent directory (/var/ossec/etc), allowing it to pass validation. After the malicious group is accepted and stored in the manager&#39;s global database, the remoted process uses this unchecked value to build paths for agent configuration synchronization. As a result, sensitive files from /var/ossec/etc, such as client.keys, ossec.conf, and internal certificates, are included in the agent&#39;s shared configuration stream and exposed to the attacker. This issue has been fixed in versions 4.10.4 and 4.14.5.</p> <p><strong>Affected:</strong> wazuh</p> <p>Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects the Wazuh Manager&#39;s enrollment daemon (authd) and synchronization daemon (remoted). The authd process allows agents to select a group during enrollment but does not filter path traversal sequences such as &#34;...&#34; While the manager checks for the group directory using wopendir(), the &#34;..&#34; sequence references the parent directory (/var/ossec/etc), allowing it to pass validation. After the malicious group is accepted and stored in the manager&#39;s global database, the remoted process uses this unchecked value to build paths for agent configuration synchronization. As a result, sensitive files from /var/ossec/etc, such as client.keys, ossec.conf, and internal certificates, are included in the agent&#39;s shared configuration stream and exposed to the attacker. This issue has been fixed in versions 4.10.4 and 4.14.5.</p> https://vulnerability.circl.lu/vuln/cve-2026-39359