CVE-2026-54084

Analyzed Analyzed - Analysis Complete

NULL Pointer Dereference in Wazuh Agent Enrollment

Publication date: 2026-08-28

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key response with fewer than four fields, causing a NULL pointer dereference. The w_enrollment_process_agent_key() routine splits the manager-provided key into four space-separated fields but does not verify that all fields are present before passing them to validators. Because OS_StrBreak() leaves missing trailing entries as NULL and OS_IsValidName() calls strlen() on its argument without a NULL check, a response such as OSSEC K:'1' reaches OS_IsValidName(NULL) and terminates the agent process. Since Wazuh permits enrollment against an unverified manager when no CA certificate is configured, an attacker operating a rogue manager or intercepting the enrollment flow can deterministically crash agents, resulting in denial of service. This issue is fixed in version 4.14.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-15

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-54084

Affected Vendors & Products

Vendor	Product	Version / Range
wazuh	wazuh	From 4.0.0 (inc) to 4.14.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Wazuh agent enrollment process in versions 4.0.0 through 4.14.6. A malicious or man-in-the-middle enrollment manager can crash a Wazuh agent by sending a malformed key response with fewer than four fields during enrollment. The agent's processing routine splits the key into four fields but fails to verify all fields exist before validation, leading to a NULL pointer dereference and agent crash.

Detection Guidance

To detect this vulnerability, monitor Wazuh agent crashes during enrollment attempts. Check logs for segmentation faults or NULL pointer errors in the w_enrollment_process_agent_key function. Use commands like 'journalctl -u wazuh-agent' or 'grep -i 'segmentation fault' /var/log/syslog' to identify crashes.

Impact Analysis

This vulnerability can cause denial of service by crashing Wazuh agents during enrollment. An attacker could exploit it by posing as a rogue enrollment manager or intercepting the enrollment flow, especially in setups without a configured CA certificate. The crash is deterministic and requires no user interaction or elevated privileges.

Compliance Impact

This vulnerability primarily causes denial of service by crashing Wazuh agents during enrollment, which could disrupt security monitoring and incident response capabilities. For compliance standards like GDPR or HIPAA, such disruptions may impact the ability to maintain continuous security monitoring, detect breaches, or respond to incidents in a timely manner, potentially leading to non-compliance with requirements for security controls and audit logging.

Mitigation Strategies

Upgrade Wazuh agents to version 4.14.7 or later. Ensure CA certificates are configured for manager-agent enrollment to prevent unverified manager interactions. Restrict network access to enrollment ports and monitor for suspicious enrollment requests.

Hi! I’m here to help you understand CVE-2026-54084. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70