Wazuh Manager 5.0 inventory_sync NDJSON Injection in OpenSearch _bulk API (GHSA-ff9g-85jq-r3g3, CVSS 10.0)
Wazuh Manager 5.0 inventory_sync NDJSON Injection in (TL-2026-0800), also tracked as GHSA-ff9g-85jq-r3g3, is a critical-severity software vulnerability scored CVSS 10, first published 2026-06-15. It has no confirmed attribution, affects Wazuh Wazuh Manager, maps to 15 MITRE ATT&CK techniques (T1046, T1070, T1078.001), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-0800
- Threat ID
- TL-2026-0800
- Also known as
- GHSA-ff9g-85jq-r3g3, Wazuh inventory_sync NDJSON Injection
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-06-15
- Last reviewed
- 2026-06-15
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, managed-security-services, government, financial, healthcare, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
An unauthenticated NDJSON injection flaw in the Wazuh Manager 5.0 inventory_sync subsystem lets any enrolled agent smuggle arbitrary OpenSearch _bulk operations through the unsanitized DataValue.index flatbuffer field, enabling deletion of security alerts, tampering of vulnerability/inventory data, and persistent payload injection into Kibana saved objects. Tracked as GHSA-ff9g-85jq-r3g3 with a maximum CVSS 3.1 score of 10.0.
How Wazuh Manager 5.0 inventory_sync NDJSON Injection in works
GHSA-ff9g-85jq-r3g3 is a critical (CVSS 10.0) injection vulnerability in the inventory_sync subsystem introduced in Wazuh Manager 5.0.0-beta1 — a code path that does not exist in the Wazuh 4.x branch. When an enrolled agent sends inventory data to the manager, the agent-controlled DataValue.index flatbuffer field is appended directly into the body of an OpenSearch _bulk NDJSON (newline-delimited JSON) request without any escaping or validation. In indexerConnectorSyncImpl.hpp the _index value is appended raw at both the bulkIndex and bulkDelete call sites (m_bulkData.append(index); // Untrusted input), while the adjacent _id field is correctly sanitized via appendEscapedId() — an asymmetry that is the root cause.
By embedding newline characters and crafted JSON action/metadata lines into the index field, an attacker injects additional bulk operations (delete, index, update) into the NDJSON payload the manager posts to the indexer. Because the injected operations execute under the manager's OpenSearch credentials — which in default deployments resolve to the admin account with the all_access role stored in the Wazuh keystore — a single agent-side injection is elevated to effective cluster-admin control over all indexed security data.
Exploitation is unauthenticated and network-reachable: Wazuh's default wazuh-authd configuration permits anonymous agent enrollment (use_password=no, ssl_verify_host=no) over TCP/1515, after which the attacker communicates over the standard remoted AES channel on TCP/1514. End-to-end public proof-of-concept code in the advisory (18-cve-f-remoted-aes.py) performs anonymous enrollment, AES-256-CBC session-key derivation, construction of a poisoned DataValue flatbuffer, and confirms targeted document deletion within ten seconds; a second harness (15-cve-f-sink-harness.cpp) isolates the NDJSON injection at the bulkIndex sink.
Impact spans defense evasion and data integrity destruction across an entire SIEM deployment: attackers can delete alerts in wazuh-alerts-* indices to erase post-compromise evidence, overwrite inventory and vulnerability state for monitored agents, write persistent payloads into .kibana_1 saved objects, and perform cross-tenant manipulation in shared environments. The Wazuh security team shipped three layered fixes in 5.0.0-beta3: sink-level escaping of _index (mirroring the existing _id escaping), boundary validation of index names in inventorySyncFacade.hpp, and downscoping the keystore credential from admin/all_access to a narrower wazuh-server role. No CVE identifier was assigned at publication; the issue is tracked solely via GHSA-ff9g-85jq-r3g3.
MITRE ATT&CK techniques used in TL-2026-0800
Discovery
T1046 Network Service Discovery
Defense Evasion
Privilege Escalation
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Collection
T1213 Data from Information Repositories
Impact
T1485 Data Destruction; T1491.001 Internal Defacement; T1565.001 Stored Data Manipulation; T1565.002 Transmitted Data Manipulation
Persistence
T1505 Server Software Component
Credential Access
T1552.001 Credentials In Files
Reconnaissance
defense-impairment
T1685 Disable or Modify Tools; T1685.006 Clear Linux or Mac System Logs
Affected products and versions in Wazuh Manager 5.0 inventory_sync NDJSON Injection in
- Wazuh — Wazuh Manager
Vulnerable versions: 5.0.0-beta1; 5.0.0-beta2
Fixed in: 5.0.0-beta3 - Wazuh — Wazuh (4.x branch)
Fixed in: not affected - inventory_sync subsystem absent in 4.x
Remediation for Wazuh Manager 5.0 inventory_sync NDJSON Injection in
Patches
- Wazuh Manager 5.0.0-beta3 (fixes GHSA-ff9g-85jq-r3g3)
Immediate actions
- Upgrade Wazuh Manager to 5.0.0-beta3 or later, which escapes the _index field at the sink, validates index names at the boundary, and downscopes keystore credentials
- Disable anonymous agent enrollment: set use_password=yes in wazuh-authd and require agent enrollment passwords
- Enforce ssl_verify_host=yes and certificate-based agent verification on the enrollment service (TCP/1515)
Workarounds
- Disable anonymous agent enrollment (use_password=no -> use_password=yes)
- Downscope the indexer service account away from admin/all_access
- Block untrusted access to TCP/1514 and TCP/1515 at the network perimeter
Longer-term hardening
- Replace the default OpenSearch admin/all_access keystore credential with a narrowly scoped wazuh-server role limited to required indices and actions
- Implement strict index-name validation per OpenSearch naming rules for all manager-to-indexer bulk requests
- Restrict network access to TCP/1514 and TCP/1515 to known agent subnets via firewall/segmentation
- Enable immutable/append-only or snapshot-based protection on wazuh-alerts-* indices to preserve forensic evidence
Weaknesses (CWE) in Wazuh Manager 5.0 inventory_sync NDJSON Injection in
CWE-74, CWE-93, CWE-863
Timeline of Wazuh Manager 5.0 inventory_sync NDJSON Injection in
- Vulnerability publicly reported by Cyber Security News and Cyberpress, highlighting alert tampering and forensic-evidence destruction across affected Wazuh 5.0 deployments.
- Fix shipped in Wazuh Manager 5.0.0-beta3: sink-level escaping of _index, boundary validation of index names in inventorySyncFacade.hpp, and credential downscoping from admin/all_access to a narrower wazuh-server role.
- At publication no CVE identifier had been assigned; the vulnerability is tracked solely via GHSA-ff9g-85jq-r3g3 despite its maximum CVSS 10.0 rating.
- The advisory documented a concrete injection payload — a crafted _index value carrying a newline and a smuggled {"delete":{"_index":"wazuh-alerts-*","_id":"target-doc"}} bulk action — proving arbitrary OpenSearch operations can be injected into the manager's _bulk request.
- Researchers demonstrated targeted document deletion within ten seconds via anonymous enrollment, AES-256-CBC session-key derivation, and a poisoned DataValue flatbuffer.
- End-to-end public proof-of-concept released in the advisory: 18-cve-f-remoted-aes.py (full attack chain) and 15-cve-f-sink-harness.cpp (isolated NDJSON injection at the bulkIndex sink).
- Maximum CVSS 3.1 base score of 10.0 assigned (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); classified under CWE-74, CWE-93, and CWE-863.
- GitHub Security Advisory GHSA-ff9g-85jq-r3g3 published for the Wazuh Manager 5.0 inventory_sync NDJSON injection.
- The inventory_sync subsystem — including the indexerConnectorSyncImpl.hpp code path that appends the agent-controlled DataValue.index directly into the OpenSearch _bulk NDJSON body — was introduced in Wazuh Manager 5.0.0-beta1; the code path does not exist in the Wazuh 4.x branch.
Sources cited for Wazuh Manager 5.0 inventory_sync NDJSON Injection in
- GitHub Security Advisory GHSA-ff9g-85jq-r3g3
- GitHub Advisory Database entry GHSA-ff9g-85jq-r3g3
- Wazuh Vulnerability Lets Attackers Inject Malicious OpenSearch Bulk Operations
- Critical Wazuh Flaw Enables Alert Tampering and Evidence Deletion
- Wazuh Releases (5.0.0 beta line)
- CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)
- CWE-93: Improper Neutralization of CRLF Sequences (CRLF Injection)
- CWE-863: Incorrect Authorization
Threats related to Wazuh Manager 5.0 inventory_sync NDJSON Injection in
- HPE Patches Critical ArubaOS-CX Buffer Overflow (CVE-2026-73749) Enabling Unauthenticated Remote Code Execution
- Bendix EC80 Truck Brake Controller: 2024 Safety Recall Covertly Patched RCE and DoS Vulnerabilities
- Cisco Secure Workload CVE-2026-20223 — Maximum-Severity Unauthenticated Site Admin Privilege Escalation via Internal REST API Access-Validation Flaw
Detection coverage for TL-2026-0800
As of 2026-06-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0800 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.