CVE-2026-67307

Wazuh 5.0.0-beta1 fails to validate or override the cluster_name and cluster_node fields in inventory-sync Start FlatBuffer messages, checking only that the agentid matches the authenticated agent identity (CWE-345, insufficient verification of data authenticity). A low-privileged enrolled agent can exploit this by sending crafted inventory-sync messages that forge the wazuh.cluster.name value and influence the document _id prefix in indexed inventory and vulnerability documents. This lets the attacker tamper with inventory records and, in shared-indexer multi-cluster deployments, poison another cluster's records when numeric agent IDs collide; CVSS 4.0 scores the issue 7.0 (High) with high integrity impact on the affected and subsequent systems. Deployments running Wazuh 5.0.0 prerelease builds before 5.0.0-beta3 are affected, with multi-cluster environments sharing an indexer facing the greatest risk. No in-the-wild exploitation is currently known: public proof-of-concept references exist (VulnCheck and a GitHub security advisory), EPSS is 0.2% (9th percentile), and the issue is not in CISA KEV.

What to do: Upgrade to Wazuh 5.0.0-beta3 or later. In the meantime, especially in shared-indexer multi-cluster deployments, review indexed inventory and vulnerability documents for unexpected wazuh.cluster.name values or _id prefixes and check for records overwritten via numeric agent ID collisions across clusters. Restrict agent enrollment to trusted hosts and monitor inventory-sync traffic for anomalous cluster field values until patched.