CVE-2026-67307Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync
Updated under an hour ago ()
Does this affect you?
It affects wazuh. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override the cluster_name and cluster_node fields in inventory-sync Start FlatBuffer messages, while validating only the agentid against the authenticated agent identity. This allows a low-privileged enrolled agent to spoof cluster attribution in indexed inventory and vulnerability documents by forging wazuh.cluster.name values and influencing the document _id prefix, potentially tampering with inventory records or, in shared-indexer multi-cluster deployments, poisoning another cluster's records when numeric agent IDs collide.
- CVSS
- 6.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
- Weakness (CWE)
- CWE-345
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Analyzed
- Record last updated
- Aug 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
wazuh wazuh wazuh:wazuh (from the name) | before 5.0.0-beta3; 5.0.0-beta3 not affected | CNA record |
wazuh wazuh wazuh:wazuh | 5.0.0 | NVD |
References
- https://github.com/wazuh/wazuh/security/advisories/GHSA-jv5p-fhwh-9w55vendor-advisory, exploit, mitigation
- https://github.com/wazuh/wazuh/commit/b3dae02ec9ddcfd449cb61b4c76d180e3e43f79apatch
- https://www.vulncheck.com/advisories/wazuh-before-beta3-cluster-attribution-spoofing-via-inventory-syncthird-party-advisory, exploit, patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.