CVE-2026-67307

HighCVSS 7.7/10Last modified Sep 1, 2026

Description

Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override the cluster_name and cluster_node fields in inventory-sync Start FlatBuffer messages, while validating only the agentid against the authenticated agent identity. This allows a low-privileged enrolled agent to spoof cluster attribution in indexed inventory and vulnerability documents by forging wazuh.cluster.name values and influencing the document _id prefix, potentially tampering with inventory records or, in shared-indexer multi-cluster deployments, poisoning another cluster's records when numeric agent IDs collide.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
wazuh	wazuh	< 5.0.0-beta3

References

https://github.com/wazuh/wazuh/commit/b3dae02ec9ddcfd449cb61b4c76d180e3e43f79aPatch
https://github.com/wazuh/wazuh/security/advisories/GHSA-jv5p-fhwh-9w55Exploit, Mitigation, Vendor Advisory
https://www.vulncheck.com/advisories/wazuh-before-beta3-cluster-attribution-spoofing-via-inventory-syncExploit, Patch, Third Party Advisory

Timeline

Published: Aug 1, 2026
Last modified: Sep 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-673089.3Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands CVE-2026-673097.5Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget mid CVE-2026-67317.5X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CVE-2026-673105.4OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks end CVE-2026-673116.8Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP r CVE-2026-673127.5axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.for CVE-2026-673137.5axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bra CVE-2026-673146.5axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and CVE-2026-673157.5axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowi CVE-2026-673167.4axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been poll CVE-2026-673177.5axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-CVE-2026-673185.3axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests a