WAZUH

Güvenlik duyuruları

Geliştiricilerin GitHub'da yayınladığı duyurular. Yalnızca başka yerde, örneğin NVD'de bildirilen açıklar dahil değil.

• GHSA-cjf8-wjx6-hjw6 CVE-2026-74041 Kritik 13 Eki 2026
  Case-sensitivity mismatch bypasses remote-command validation, allowing command execution as root
• GHSA-vc33-wcqf-cwgv CVE-2026-74033 Orta 13 Eki 2026
  Missing destination-path validation in CDB list cluster-callable handlers allows arbitrary file read/delete on the manager
• GHSA-3xm6-wp5v-2fm9 CVE-2026-74037 Yüksek 13 Eki 2026
  Improper session invalidation in check_token: revoking a run_as user's administrator grant does not invalidate their token, enabling permanent self-re-grant of administrator
• GHSA-27gv-q7q6-f5qh CVE-2026-74035 Yüksek 13 Eki 2026
  An empty password bypasses both the password policy and the reserved user guard in `security.update_user`, allowing a delegated user administrator to take over the `wazuh` superuser account
• GHSA-gc4j-j9fg-4cfr CVE-2026-74045 Yüksek 13 Eki 2026
  Heap buffer overflow in wazuh-analysisd fim_generate_alert() lets an enrolled agent corrupt manager heap memory and terminate the analysis engine
• GHSA-crrg-5qvw-8wjx CVE-2026-93346 Orta 13 Eki 2026
  API brute-force protection is still bypassable by concurrent login requests, the `asyncio.Lock` fix for GHSA-m2mr-xhhv-jx58 serializes the counter but does not close the check-then-count race
• GHSA-qmhg-366r-jjfp CVE-2026-74036 Yüksek 13 Eki 2026
  Remote code execution as root on Wazuh agents via SCA command policies
• GHSA-xrjw-cqrv-j92g CVE-2026-93347 Orta 13 Eki 2026
  Path traversal in cluster-callable get_list_file allows arbitrary file read as the wazuh user
• GHSA-w4qc-m4j4-6m9c CVE-2026-74031 Orta 13 Eki 2026
  Path traversal in cluster-callable rule/decoder delete helpers allows arbitrary file deletion as the wazuh user
• GHSA-r7hm-43xr-477j CVE-2026-74034 Yüksek 13 Eki 2026
  Arbitrary file read as root via agent-injected upgrade_custom command
• GHSA-qj8j-r988-54rx CVE-2026-74047 Orta 13 Eki 2026
  authd.pass disclosed to low-privileged users through the per-agent active configuration endpoint
• GHSA-vh8p-3xvw-w536 CVE-2026-74032 Orta 13 Eki 2026
  RBAC Authorization Bypass in Wazuh API
• GHSA-88p6-7cm8-xwj8 CVE-2026-74040 Kritik 13 Eki 2026
  Cluster worker can overwrite arbitrary master files (incl. ossec.conf) → root RCE on manager and every agent — bypass of #36296 excluded_files guard + missing extra_valid enforcement
• GHSA-cw26-jj8q-x7w5 CVE-2026-74043 Kritik 13 Eki 2026
  Path traversal in cluster-callable upload functions allows arbitrary file write as the wazuh user
• GHSA-x8v7-g49q-ff7j CVE-2026-74030 Orta 13 Eki 2026
  SCA YAML alias expansion causes memory exhaustion
• GHSA-whhr-gxxr-f6pm CVE-2026-62365 Orta 18 Ağu 2026
  Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML
• GHSA-9wv5-7qwx-m9w5 CVE-2026-61811 Orta 18 Ağu 2026
  Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion
• GHSA-vjcq-cf36-f5gx CVE-2026-61783 Yüksek 18 Ağu 2026
  RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key
• GHSA-chmg-89pf-2q82 CVE-2026-61802 Orta 18 Ağu 2026
  Cluster authentication key disclosed to low-privilege cluster:read API users via GET /cluster/local/config (missing mask_sensitive_config) — enables cluster-peer RCE chain
• GHSA-3jff-488g-335f CVE-2026-61800 Yüksek 18 Ağu 2026
  Incomplete fix for CVE-2026-30893: missing directory confinement in cluster worker file sync allows arbitrary file write under /var/ossec on worker nodes

hackshelf'in gördüğü değişiklikler

• 19 Eki 2026 İlk kontrol, durum Aktif

Endpoint Monitoring kategorisindeki diğer araçlar

• OSSEC Aktif son commit dün
• Sysmon for Linux Aktif son commit 35 gün önce
• go-audit Aktif son commit 41 gün önce
• Sysdig Yavaşlıyor son commit 189 gün önce
• Kolide Fleet Arşivlenmiş sahibi arşivlemiş, son commit 2134 gün önce
• Zeek Agent Arşivlenmiş sahibi arşivlemiş, son commit 2161 gün önce