GitHub Release: wazuh/wazuh v5.0.0-beta5 (01.09.2026)

$ git clone https://github.com/wazuh/wazuh.git Clone

What's Changed

• fix(ci): correct S3 artifact run directory layout for 4.14.7 by


• Lower log level of transient cluster failures by


• Fix github actions shell by


• SCA Policy Adjustments by


• Bump 4.14.8 branch by


• fix(ci): grant OIDC to Coverity S3 jobs by


• Remove unnused assignment for bpf object by


• Fix changelog workflow by


• Preserve original scan_day/scan_time strings in syscheck config by


• Multi SCA, Decoder and Rule fixes by


• Improve API authentication stability and resource limits by


• Bump 4.14.7 branch by


• Update CHANGELOG for v4.14.7 by


• Adjusted file sizes in the check files by


• Compilation error in HP-UX arch by


• Maintain crypto_method on keystore rebuild by


• Merge 4.14.7 into 4.14.8 by


• Fix RBAC permission bypass in GET /security/actions and /security/resources by


• Validate destination paths when uploading list, rule, and decoder files by


• Prevent cluster worker from overwriting protected master files by


• Improve access control on the agent active-configuration endpoint by


• Fix typo in SCA rules by


• Prevent race condition in Windows RSA key container initialization (randombytes) by


• Limit node expansion in yaml2json by


• Reorder revoke-token from API integration test by


• Fix benchmark test_cluster_error_logs test by


• Correct EnableMulticast expected value in Windows LLMNR checks by


• Prevent spurious CRITICAL (1211) queue error during rootcheck/FIM shutdown on WPK upgrade by


• Add sshd-session/sshd-auth to default macOS ULS query by


• Remove multiple warning messages for each unathorized shared policy by


• Fix typo in SCA rules by


• Restore legacy 5.0 deprecation notes and update wm_control migration by


• Fix analysisd deadlock on AR send when the queue is not drained by


• Disable OpenSSL runtime CPU probing in Python daemon wrappers by


• Disable OpenSSL runtime CPU probing in Python daemon wrappers by


• Expose audit_uid, audit_gid and effective_uid in eBPF whodata provider by


• Fix flaky Windows syscollector test by


• Reject upgrade commands from the agent channel in wazuh-analysisd by


• initializeContext thread-safe with std::call_once by


• Bump 5.0.0 branch by


• Validate destination paths when deleting rule and decoder files by


• Make sure dbs are fully closed before stop() returns (sca, syscollector, agent-info) by


• Use DisplayName and python.exe version for Microsoft Store packages by


• Fix analysisd flaky test by


• Migrate AWS integration tests to OIDC authentication and pre-existing VPC [5.0.0] by


• Migrate AWS integration tests to OIDC authentication and pre-existing VPC [4.14.7] by


• Update MITRE mapping in Microsoft Graph rules by


• Validate read path in CDB list file retrieval by


• Merge 4.14.7 into 4.14.8 by


• Provide local TZDB for integration tests by


• Explicit use of jemalloc on daemons by


• Fix flaky content manager component tests caused by a race in the fake server startup by


• Merge 4.14.8 into 5.0.0 by


• Fix WM_MAX_WAITunit comment modified (milliseconds -> microseconds) by


• Fix Windows agent Event-handle leak from per-cycle COM init in syscollector hotfixes collector by


• Downgrade benign syscollector shutdown-timeout log by


• Discard_regex values containing a space break argument parsing by


• Decouple authd use_password invalid test from the manager restart return code by


• Prevent empty string version from being stored for agents by


• Fix compilation with newer GCC: missing cstdint includes in versionMatcher headers by


• Reliably start workload daemons on install and shared-config reload by


• Cap engine unit-test build parallelism to prevent OOM by


• agent-info: propagate manager cluster_name change to connected agents by


• fim_scan_mutex critical section extended to held through the post-transaction sync writes by


• Resolve Coverity findings for 5.0.0 Beta 4 - Agent by


• Keep package_installed as a string through dbsync, convert to epoch only in the ECS event by


• fix default macOS group_description by


• Prevent exiting Wazuh-DB worker when oversized message arrives. by


• Stop the deferred sync-flag update from inserting partial rows by


• Notify pause() waiters on Syscollector shutdown by


• Skip feed-update vulnerability scan for agents without package inventory by


• Classify SCA policy remoteness by activation source, not file path by


• Merge 4.14.8 into 5.0.0 by


• Reject undersized legacy-format agent messages in wazuh-remoted by


• Remove WMI dependancy when installing msi packages by


• Fix macos drain autoreleased OD objects in genAccountPolicyData by


• Initialize primitive members in parsec::Trace and base::result::Result by


• Fix resource leaks when upgrade command params carry duplicate keys by


• Fix out-of-bounds read in logpar group end-token resolution (CID 558406) by


• Render each changelog block as a table by


• Remove startup deprecation warning from agent_upgrade by


• Exclude monotonic counters from syscollector dbsync diff/checksum by


• Improve login attempt limiting under concurrent requests by


• Fix out-of-bounds write when generating FIM alerts in wazuh-analysisd by


• Close the SCA DBSync connection on module stop by


• Do not unwind wazuh-syscheckd while the FIM threads are still running by


• Enforce PCI DSS 12-character minimum for API user passwords and adapt affected tests by


• Enforce password validation for empty passwords in update_user by


• Revert test/lint workflows from CodeBuild to GitHub-hosted runners by


• Bump 4.14.9 branch by


• Enforce token revocation for run_as (authorization-context) API sessions by


• Fix wildcard matching in the installed-files check by


• Prevent orphaned S3 artifacts and false-positive collisions in AWS integration tests [5.0.0] by


• Prevent orphaned S3 artifacts and false-positive collisions in AWS integration tests [4.14.8] by


• join module worker thread in stop_wmodules() before reporting stopped by


• Report macOS 26 and 27 release codenames by


• Validate CDB list paths in list-retrieval and delete cluster callables by


• Skip 4.x CI checks on draft pull requests by


• Fix remote-command configuration validation by


• Fix bad formatted vulnerability scanner database workflow by


• Revert agent workflows to GitHub runners 4x by


• Merge 4.14.8 into 4.14.9 by


• Migrate the agent package-build workflows to GitHub-hosted runners by


• Release Windows hotfixes' per-thread COM context on the calling thread instead of at thread exit by


• Merge 4.14.9 into 5.0.0 by


• Perpended string "data." in field names removed from FortiAuth rules and decoders by


• Migrate candidate workers from AWS to Github-hosted runners by


• Remove stale EC2-timing exclusion in syscollector-rtr by


• Silence GMock warnings for releaseThreadResources() in syscollector tests by


• Reject symlinks when writing files staged under the incoming directory by


• Validate read paths in group configuration and daemon stats retrieval by


• Fix Windows agent crash on reconnection when the manager rejects its key by


• Windows agent: safer MSI upgrade under a pending system restart by


• Add sccache compilation caching to the legacy unit tests and syscollector RTR workflows by


• Prevent Windows agent crash when promoting FIM registry rows whose configuration was removed by


• Port deferred 4.14.7 cluster security fixes to 5.0.0 (confinement, decompression cap, config masking) by


• Merge 4.14.8 into 4.14.9 by


• Improve translation mechanism by


• Merge 4.14.9 into 5.0.0 by


• Introduce HTTPS-based agent-manager communication protocol by


• fix(sync-protocol): publish agent metadata in test tool to stop RTR hang by


• Fix documentation build failure due to missing manager coordinator migration guide by


• Suppress StarletteDeprecationWarning for cluster_control and all framework CLI tools by


• Prevent the agent from stopping Active Response when too many commands are defined by


• Retire the three dead remoted counters and fix the endpoint that serves them by


• Stop broadcasting token revocation to worker nodes by


• Fix timeout waiting for SCA to complete shutdown by


• Fix WPK agent upgrade silently failing on systems without the find binary by


• Correct documentation inaccuracies and update GeoIP manifest URL by


• Backport: Free rpm macro context to stop unbounded growth by


• Resolve group names once per scan instead of once per user and group by


• Bound the control message copy to the source string length in remoted by


• Close idle pre-authentication connections in the cluster server by


• Restrict wazuh-manager-apid status reporting to master nodes by


• Allow skipping the manager connectivity check during WPK upgrade for testing by


• Fix workflow syntax and S3 upload call in VD Scanner tools Delivery by


• Change Warning message to Info for client buffer config by


• Detect and recover from silently half-closed TCP connections by


• Unify the manager's HTTP-over-UDS servers on a shared transport (uds_http_server) by


• Enable zstd compression by default on the agent by


• Fix all 16 Coverity findings from 5.0.0-HTTPS validation scan by


• Report disabled root decoder during policy promotion by


• Own the systemd D-Bus connection so the services collector recovers after a bus restart by


• Added ssl and batch block to agent's configuration report by


• Windows agent HTTPS 401 clock-skew by


• Gate 4.x-specific remoted subsystems behind the legacy configuration block by


• Persist the agent version at startup and stop throttling the first host-carrying notify by


• Resolve the audited path for single-item whodata events and restore the FIM whodata integration tests by


• Agent and manager default connection timing parameters by


• Move the 4.14.8 server workflows to GitHub-hosted runners and add sccache compilation caching by


• Scanhotfixes wmi timeout by


• Enforce client.keys source address and harden HTTPS config validation in remoted by


• fix compression agent configuration by


• Fixed the parameter for debug symbols used in package generation by


• Address first-party Coverity findings by


• Support static IP agent registration in HTTPS remoted by


• Make module stop() callbacks signal-only so modules do not deadlock each other on shutdown by


• Add HTTPS agent enrollment endpoint (POST /enroll) bridging to authd by


• wazuh-manager: Improve inv sync and remoted stats by


• Bound Snort full record appends to the available buffer space by


• Bump 5.0.0 branch by


• Close the FIM synchronization database before reporting SERVICE_STOPPED on Windows by


• Avoid holding exec_sock_mutex while connecting to the exec queue by


• Quote interpolated paths before passing them to the shell in the engine tools by


• Wait out transient SQLite locks instead of failing agent startup by


• Fix world-writable bundled Python files introduced by the DEB permission restoration script by


• Merge 4.14.8 into 4.14.9 by


• Agent-side enrollment over HTTPS: consume the new POST /enroll endpoint, retire the legacy 1515 protocol by


• Fix Windows module threads created after shutdown by


• Migrate wazuh_db HTTP API from httpsrv to uds_http_server by


• Reduce wazuh-agentd resident memory and per-request signing cost by


• Merge 4.14.9 into 5.0.0 by


• Fix memory leak in the analysisd JSON decoder when an event repeats a field by


• syscollector normalizer: stop erasing while iterating in removeExcluded() (4.14.9) by


• Handle Windows event field names as literal JSON keys by


• Stop serving the OpenAPI spec unauthenticated at /openapi.json by


• Fix missing package-installed events after agent restarts by


• Correct the HTTPS agent-manager protocol documentation and the contract mismatches it exposed by


• Raise the number of Active Response commands the agent can load by


• Allow skipping the manager connectivity check during Windows WPK upgrade for testing by


• Allow enrolling an agent whose name matches the manager hostname over the local socket by


• Rename the agent's connection block to <agent><manager> by


• Harden indexer communication timeouts by


• Implement parallel Vulnerability Detector scans by


• Unblock enrollments when agent deletion pipeline stalls by


• Enhancement/38491 remoted global prefix by


• Probe the audisp plugin configuration instead of trusting the audit version by


• Integrate endpoint prefix configuration for agent by


• Pin the Azure Graph pagination URL to the Microsoft Graph endpoint by


• fix(api): bound search length and harden wazuh-db error handling by


• Reject symlinks when reading and staging files during agent upgrade by


• Rename every manager Unix socket to a single standard and gather them in one directory by


• Agent-side: new verification_mode=system to validate the manager's certificate against the OS CA store by


• Ignore obsolete 4.x configuration elements instead of rejecting them by


• Log transport-level errors by


• Log an expected shutdown-time DBSync miss at DEBUG instead of WARNING by


• Report local sync intake unreachable as deferred instead of a hard failure by


• Set default prefix value when installing agent by


• Restore username validation in the active response framework by


• Fix false positives for Debian backports packages in Vulnerability Detection by


• Fix out-of-bounds read when a quoted CSV/DSV field ends the input by


• AWS integration tests: isolate concurrent runs on the shared bucket with a per-run S3 namespace (GITHUB_RUN_ID) [4.14.8] by


• AWS integration tests: isolate concurrent runs on the shared bucket with a per-run S3 namespace (GITHUB_RUN_ID) [5.0.0] by


• Use posix-flavour MinGW C compiler for the winagent CMake build by


• fix(sca): align SCA policy checks with documented HIPAA mappings by


• Fix stateful DELETE events being dropped for files first seen via realtime/whodata by


• remoted: authenticate agents and enrollment with JWT bearer profiles (wazuh-agent+jwt / wazuh-enroll+jwt) by


• Remove leftover Login Item configuration by


• Improve Auth and Inventory-sync documentation by


• Accept any identifier format for content resources by


• Replace order-preserving std::vector::erase with swap-and-pop where element order doesn't matter by


• Verify the Fluentd server identity in the fluent-forward module by


• Document that agent and manager only share a host when both are 5.x by


• Fix deletion of agent config and stats by


• Add agent.config_token to the /control notify response by


• Demote agent-lifecycle logs to debug and report global_prefix in getRemoteConfig by


• Stop losing legacy remote_upgrade tasks by


• Sync the VD inventory when the manager reports no feed offset by


• Fix startup reporting, control-plane error propagation, option validation and inventory-sync bounds by


• Merge 4.14.8 into 4.14.9 by


• JWT several fixes by


• Review manager logging by


• API endpoint to trigger on-demand Vulnerability scans. by


• Unify the manager address, port and prefix into a single by


• Restore client buffer deprecation info on 5x by


• Merge 4.14.9 into 5.0.0 by


• WPK upgrade: manager reachability check falls back to TCP only on TLS 1.3 mismatch by


• fix(remoted): log authd.pass wait as DEBUG while a worker is joining by


• Fixed two checks with bugs in Amazon Linux 2023 by


• Recover a re-enrolled agent's data instead of waiting for a checksum mismatch by


• Stabilize flaky Windows FIM integration tests with teardown retries by


• Drop netstat and last from the default command-monitoring template by


• Apply manager-not-ready tolerance to the pre-sync DataClean by


• Add consumer-level test coverage for SyncModuleResult classification flags by


• Enhancement/38296 indexer connector staging sync by


• Bump 5.0.0 branch by

Full Changelog: v5.0.0-beta4...v5.0.0-beta5