CVE-2026-67307: wazuh

Vulnerability summary

CVE-2026-67307 is a high (CVSS 7.7) vulnerability in wazuh. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.5% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 01-08-2026
   PublishedVulnerability first disclosed.
2. 03-08-2026
   Last modifiedVulnerability information updated.

Description

Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override the cluster_name and cluster_node fields in inventory-sync Start FlatBuffer messages, while validating only the agentid against the authenticated agent identity. This allows a low-privileged enrolled agent to spoof cluster attribution in indexed inventory and vulnerability documents by forging wazuh.cluster.name values and influencing the document _id prefix, potentially tampering with inventory records or, in shared-indexer multi-cluster deployments, poisoning another cluster's records when numeric agent IDs collide.

• CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.