External risk intelligence

Wazuh Manager NDJSON Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-56699

The vulnerability involves communication between enrolled agents and the Wazuh Manager. While this is network-based, agent-to-manager traffic is typically restricted to internal infrastructure and managed via specific enrollment processes, making direct public internet exposure uncommon in standard deployments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Wazuh Manager that could allow enrolled agents to manipulate critical security data by injecting malicious operations. This occurs when the manager improperly handles data values, enabling unauthorized document deletion, alert tampering, and manipulation of security information across agents.

Agents can alter security data and alerts.
Leadership should recall risks to security data integrity.
Confirm relevance and exposure of this system.

Attack Path

How an attacker could exploit the issue

An attacker with access to an enrolled agent could manipulate data sent to the Wazuh Manager. By crafting special requests, they can inject commands that the manager executes with its own administrative privileges, potentially altering or deleting critical security data.

Requires an enrolled agent.
Injects commands via agent data.
Risks data tampering and deletion.

Live Threat

Current exploitation, exposure, and threat context

Wazuh Manager could allow enrolled agents to inject arbitrary NDJSON operations into OpenSearch bulk requests, potentially impacting system data and service behavior. This could occur when the `DataValue.index` field is not properly escaped, enabling attackers to execute delete, index, or update operations under the manager's administrative credentials. The consequences may include document deletion and alert tampering when supported by the advisory.

System data and alerts at risk.
Agents inject NDJSON operations.
Document deletion and alert tampering.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Wazuh Manager deployments where agents can interact with the manager's OpenSearch bulk requests. The immediate priority is for infrastructure or platform teams to identify all instances of the affected Wazuh Manager, assess their network exposure and criticality, and confirm ownership. Once these are understood, a coordinated remediation plan, potentially involving vendor coordination or temporary risk reduction measures, can be developed and executed, likely during a planned maintenance window.

Infrastructure or Platform Teams should own the issue.
Verify manager reachability and asset criticality.
Plan remediation during a maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Wazuh Manager?

Wazuh Manager is the central brain of the Wazuh security platform. It collects, processes, and analyzes data from various sources to provide security monitoring, threat detection, and compliance management. In enterprise setups, it interacts with installed agents across systems to aggregate security information into a backend, often OpenSearch, where data is indexed for analysis.

What is the vulnerability in CVE-2026-56699?

This vulnerability is an injection weakness, specifically CWE-74. It happens because the software fails to properly sanitize input in the DataValue.index field before sending it to the OpenSearch database. Because the manager processes these requests with its own high-level administrative permissions, an attacker can smuggle malicious operations—like deleting or modifying documents—into what should have been a standard data update.

How does an attacker trigger this bug?

The attack requires control over an enrolled agent that is already authorized to communicate with the manager. If an agent is compromised, an attacker can send a crafted request containing malicious NDJSON commands. The vulnerability is not triggered by arbitrary network traffic from unknown sources; it relies on the specific communication path between a legitimate, enrolled agent and the manager.

Do I need to worry if my Wazuh Manager is internal?

Halo Surface Signal notes that while this is a network-based issue, these managers are typically hosted within private, internal infrastructure rather than exposed directly to the public internet. If your manager is only reachable by trusted internal agents, the potential for outside exploitation is significantly lower than for a system exposed to the open web.

What should I do to respond to this vulnerability?

Start by identifying all instances of Wazuh Manager within your environment to understand your footprint. Prioritize these assets based on how critical the data they handle is to your operations. Once identified, work toward applying the vendor-provided update or official patch to resolve the underlying input handling issue, ideally during a scheduled maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.