CyberRota Analysis
AI-GeneratedWazuh versions prior to 5.0.0-beta3 are vulnerable due to inadequate validation of the cluster_name and cluster_node fields in inventory-sync messages, allowing low-privileged agents to spoof cluster attribution. This could lead to tampering with inventory records and potentially poisoning data in multi-cluster deployments when agent IDs collide. Organizations using Wazuh for inventory management and vulnerability tracking should prioritize this issue to mitigate risks associated with data integrity and cross-cluster contamination.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override the cluster_name and cluster_node fields in inventory-sync Start FlatBuffer messages, while validating only the agentid against the authenticated agent identity. This allows a low-privileged enrolled agent to spoof cluster attribution in indexed inventory and vulnerability documents by forging wazuh.cluster.name values and influencing the document _id prefix, potentially tampering with inventory records or, in shared-indexer multi-cluster deployments, poisoning another cluster's records when numeric agent IDs collide.