CVE-2026-67307 wazuh CVE debrief

Who should care

Organizations using Wazuh 5.0.0-beta1, especially those with shared-indexer multi-cluster deployments, should be aware of the potential for cluster attribution spoofing and take steps to mitigate the vulnerability. Operators, platform administrators, and security teams should review system configurations and prioritize upgrading to Wazuh 5.0.0-beta3 or later. Vulnerability management and security teams should monitor for potential tampering with inventory records and review compensating controls for exposed systems.

Technical summary

The Wazuh 5.0.0-beta1 version does not validate or override the cluster_name and cluster_node fields in inventory-sync Start FlatBuffer messages. This allows a low-privileged enrolled agent to spoof cluster attribution in indexed inventory and vulnerability documents by forging wazuh.cluster.name values and influencing the document _id prefix. The vulnerability can be mitigated by upgrading to Wazuh 5.0.0-beta3 or later. Affected systems should be reviewed for potential tampering with inventory records.

Defensive priority

Organizations using Wazuh 5.0.0-beta1 should prioritize upgrading to 5.0.0-beta3 or later to address the cluster attribution spoofing vulnerability.

Recommended defensive actions

• Upgrade to Wazuh 5.0.0-beta3 or later
• Review and validate agent identities and inventory records
• Monitor for potential tampering with inventory records
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE description indicates that Wazuh 5.0.0-beta1 does not validate or override the cluster_name and cluster_node fields in inventory-sync Start FlatBuffer messages. This allows a low-privileged enrolled agent to spoof cluster attribution in indexed inventory and vulnerability documents. The issue is fixed in Wazuh 5.0.0-beta3. Evidence limits suggest that further verification is needed to confirm affected scope and severity. Defenders should review official advisories and verify system configurations.

Official resources