CVE-2026-54084: Wazuh agent enrollment NULL pointer dereference via malformed manager response
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key response with fewer than four fields, causing a NULL pointer dereference. The wenrollmentprocessagentkey() routine splits the manager-provided key into four space-separated fields but does not verify that all fields are present before passing them to validators. Because OSStrBreak() leaves missing trailing entries as NULL and OSIsValidName() calls strlen() on its argument without a NULL check, a response such as OSSEC K:'1' reaches OSIsValidName(NULL) and terminates the agent process. Since Wazuh permits enrollment against an unverified manager when no CA certificate is configured, an attacker operating a rogue manager or intercepting the enrollment flow can deterministically crash agents, resulting in denial of service. This issue is fixed in version 4.14.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuh agentto a version that resolves this vulnerability.Fixed in 4.14.7
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Wazuh Agent versions 4.0.0 through 4.14.6 are affected during agent enrollment. Exposure is greatest where enrollment is performed without a configured CA certificate, because the agent permits enrollment against an unverified manager.
What must an attacker be able to do to trigger the crash?
An attacker must operate a rogue enrollment manager or intercept the enrollment flow and return a malformed key response containing fewer than four space-separated fields. No agent privileges are required, but user interaction is required because the vulnerable path is reached during enrollment.
What is the impact of successful exploitation?
The malformed response causes the Wazuh agent process to terminate through a NULL pointer dereference. The resulting impact is denial of service for the enrolling agent; the provided information does not indicate confidentiality or integrity impact.
What should teams do if they cannot upgrade immediately?
Avoid enrollment against unverified managers by configuring a CA certificate, and ensure enrollment traffic cannot be redirected or intercepted by an attacker. The issue is fixed in Wazuh Agent version 4.14.7.