What is GHSA-r2pm-mgrm-39hq?

GHSA-r2pm-mgrm-39hq is a security advisory published by GitHub Security Advisories with Critical severity. Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing...

Which CVE IDs does GHSA-r2pm-mgrm-39hq cover?

GHSA-r2pm-mgrm-39hq covers the following CVE IDs: CVE-2026-56699. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r2pm-mgrm-39hq?

GHSA-r2pm-mgrm-39hq has a CVSS v3 base score of 10.0, published by GitHub Security Advisories.

GHSA-r2pm-mgrm-39hqCriticalCVSS 10.0

Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing...

Vendor

GitHub Security Advisories

Published

July 15, 2026

Last Modified

July 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-56699 →

📋 Description

Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin credentials, enabling document deletion, alert tampering, and cross-agent SIEM state manipulation.

🔗 References (4)

https://github.com/wazuh/wazuh/security/advisories/GHSA-ff9g-85jq-r3g3
https://nvd.nist.gov/vuln/detail/CVE-2026-56699
https://www.vulncheck.com/advisories/wazuh-manager-ndjson-injection-in-inventory-sync-via-agent-controlled-datavalue-index
https://github.com/advisories/GHSA-r2pm-mgrm-39hq