CVE-2026-56699 CRITICAL

CVE-2026-56699: Wazuh Manager - NDJSON Injection in inventory_sync via Agent-Controlled DataValue.index

Vendor Wazuh

Product wazuh

Weakness CWE-74

Published July 15, 2026

Last update July 15, 2026

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin credentials, enabling document deletion, alert tampering, and cross-agent SIEM state manipulation.

Key dates

02Disclosure timeline

July 15, 2026 CVE published

July 15, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-56699 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/74.html AskarLabs — CWE-74 write-up Improper Neutralization of Special Elements in Output ('Injection')

Related vulnerabilities

04Related CVE

CVE-2022-21663 Authenticated Object Injection in Multisites in WordPress CVE-2024-1128 Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A CVE-2024-38700 WordPress WPCS – WordPress Currency Switcher Professional plugin <= 1.2.0.3 - Arbitrary Shortcode Execution vulnerability CVE-2026-5797 Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields CVE-2023-6164 MainWP Dashboard <= 4.5.1.2 - Authenticated(Administrator+) CSS Injection