CVE-2026-45798 wazuh CVE debrief

Who should care

Defenders responsible for Wazuh installations, particularly those using versions 4.5.0 through 4.14.6 and 5.0.0-beta2, should assess exposure and apply patches to prevent potential denial-of-service attacks.

Why it matters

CVE-2026-45798 is a remote denial-of-service vulnerability in Wazuh versions from 4.5.0 until 4.14.6 and 5.0.0-beta2. Defenders should verify exposure, apply patches, and restrict access to the wazuh-authd service to prevent potential attacks.

• Denial of service before authentication
• Potential disruption of security monitoring and incident response
• Need for verification of Wazuh version exposure
• Priority for patching vulnerable Wazuh installations

Technical summary

The compare_wazuh_versions() function in src/shared/version_op.c copies an attacker-controlled enrollment V: field into a 10-byte stack buffer with strncpy() but does not explicitly terminate the buffer. This allows a remote denial of service before authentication when anonymous TLS enrollment is enabled on TCP port 1515. A version string of at least nine non-null bytes can cause strchr() and strtok() to read beyond ver2 and can make strtok() write a null byte into adjacent stack memory, allowing for potential denial of service attacks. Defenders should prioritize verifying exposure and applying patches, as this vulnerability allows for remote denial of service before authentication.

Defensive priority

Defenders should prioritize verifying exposure and applying patches, as this vulnerability allows for remote denial of service before authentication.

Recommended defensive actions

• Verify if Wazuh versions 4.5.0 through 4.14.6 and 5.0.0-beta2 are in use and apply patches to upgrade to a fixed version.
• Restrict access to the wazuh-authd service on TCP port 1515 to trusted sources.
• Monitor for unusual activity or crashes of the wazuh-authd service.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by the compare_wazuh_versions() function in src/shared/version_op.c, which copies an attacker-controlled enrollment V: field into a 10-byte stack buffer without explicit termination. A version string of at least nine non-null bytes can cause strchr() and strtok() to read beyond ver2 and can make strtok() write a null byte into adjacent stack memory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.