[v5.0.0]
Manager
Added
| Issue | Comment |
|---|---|
| #37702 | Added HTTPS communication between Wazuh agents and the manager: a new HTTPS transport, protocol, and control plane (connection, configuration, statistics, task dispatch, remote upgrade, and event ingestion) replacing the legacy MQ/DGRAM-based agent-manager protocol end to end. |
| #29585 | Added the Wazuh Engine as wazuh-manager-analysisd, replacing the 4.x analysisd end to end: event ingestion from remoted and the other manager modules, a new ruleset with decoders, event filters and IOC and GeoIP enrichment, alerts.json/archives.json output, configuration validation and the metrics served through GET /cluster/{node_id}/daemons/stats. It can also run as a standalone binary. |
| #30292 | Added the server-side Inventory Sync module in wazuh-manager-modulesd, which receives the agents' stateful inventory sessions (FIM, System Inventory, SCA) over HTTPS and propagates them to the Wazuh Indexer transactionally, replacing the legacy rsync/wazuh-db synchronization path. |
| #31295 | Added cluster-by-default deployment model: all Wazuh Server installations now run as a cluster node, removing the distinction between clustered and non-clustered deployments. The cluster.disabled configuration option has been removed. |
| #35623 | Added CVSS v4.0 support to the Vulnerability Scanner. |
| #36000 | Added new CVE 5.0 schema fields to the Vulnerability Detector content model. |
| #35579 | Added manager watermarks. |
| #37706 | Added default API role mappings for the indexer users wazuh-admin, wazuh-readonly and wazuh-demo. |
| #38157 | Added installation-time variables to customize the default <remote> configuration on source, DEB, and RPM manager installations. |
| #38553 | Added the PUT /agents/scan/vulnerability endpoint to trigger an on-demand vulnerability scan for one agent, a list of agents, or all agents. |
| #38589 | Added recurring manager tasks to the Task Manager: the agent disconnection sweep, the deletion of long-disconnected agents, and manager log rotation now run as durable, retried tasks inside wazuh-manager-modulesd. Their resolved settings are reported by GET /manager/configuration/wmodules/wmodules. |
| #38862 | Added a warning logged by wazuh-manager-apid on every start for each API default user (wazuh, wazuh-internal-client) whose password is still the one shipped with the package, pointing at bin/rbac_control change-password. The API starts either way. |
| #38993 | Added enrollment tokens: an operator mints a token on the master (wazuh-manager-authd --create-enrollment-token --address <host>, or POST /agents/enrollment-tokens with the new RBAC actions enrollment_token:create/read/delete) that names the manager, pins its CA and carries a one-time-issued credential; a new agent pastes it and enrolls over POST /enroll on port 1517 with a wazuh-enroll+jwt bearer whose kid is the token id, without the shared enrollment password. Tokens have a TTL, an optional use cap and a description, are listed and revoked from the CLI or the API (GET/DELETE /agents/enrollment-tokens), live in etc/enrollment_tokens.json (written by the master only, replicated to the workers by the cluster like client.keys), and are refused with 9022/9023/9024 (403 on /enroll) when unknown or revoked, expired, or out of uses — a revoked token may equally be refused earlier, as remoted's uniform 401, when its own replica already knows: both answers are correct and which one an agent sees depends on who notices first. |
| #38993 | Added a per-agent re-enrollment secret: every enrollment answers a fifth field, reenroll_secret (64 hex chars, stored in global.db only, never in client.keys), and an agent that presents a wazuh-enroll+jwt bearer whose kid is its own id, signed with the key derived from that secret, keeps its id and receives a fresh key and a fresh secret — no deletion, no indexer purge (global set-agent-credentials). The master verifies the bearer (9026/9027/9028) with the same clock window as remoted (remoted.jwt_max_age/remoted.jwt_clock_skew). There is no upgrade path for a global.db created before the column: that database is recreated, and rebuilding its agent rows from client.keys does not restore the secrets — client.keys never held them — so those agents must enroll again. |
| #38994 | Added the RBAC action cluster:read_secrets, now the only thing that returns the enrollment password and the cluster key in clear through GET /cluster/local/config and the two node configuration endpoints. Until now any caller allowed to write the configuration (cluster:update_config) could read those values as a side effect, and the disclosure left no record: it is now granted by the new default policy secrets_read, held only by administrator, and checked against the node that answers -- a grant over one node does not uncover another's -- and every disclosure is logged as secret_read with the user and the fields, never the value, in api.log for the local read and in the answering node's cluster.log for the forwarded ones. cluster_admin and wazuh_indexer_admin no longer see them in clear, and an rbac.db created before this change does not receive the new policy, so its administrator sees the values masked until the database is recreated or the policy is added. The masking also fails closed: a failure while masking now fails the request instead of returning the unmasked payload. |
| #38994 | Added wazuh-manager-authd --purge-enrollment-tokens [--all] [--force] and `DELETE /agents/enrollment-tokens?status=dead |
| #39109 | Added tools/migration/wazuh-migrate-identity.py, which carries a 4.x manager's agents, groups, group configuration, enrollment password and API users into a fresh 5.0 installation. It reads the identity out of the stopped 4.x manager's files and recreates it on the 5.0 manager through the manager's own API, so the manager validates every agent and group and writes client.keys and the registry itself, then compares the result against what it carried. The connection to the API is always verified: a loopback --api-url is checked against the target's own etc/certs/root-ca.pem, any other address requires --api-ca, and plain http:// is accepted only on loopback. |
| #39554 | Added a credential resolution ladder, run from postinst/%post/install.sh at installation and again from wazuh-manager-control start, which is what the systemd unit runs. For each credential it takes, in order, what is already in the manager's own store, then a key set in the environment or in /etc/wazuh-manager/local.env (the environment wins), then -- only for what the manager owns -- a generated value, published in /etc/wazuh-manager/export/credentials.env (root:root 0600) for the dashboard on the same host. It owns WAZUH_MANAGER_API_PASSWORD and WAZUH_MANAGER_WUI_PASSWORD, seeded into rbac.db through stdin and never argv; it only consumes WAZUH_INDEXER_MANAGER_PASSWORD, which it also takes from the indexer's /etc/wazuh-indexer/export/credentials.env on the same host, stores in its keystore, and never generates or publishes. The installer always exits 0 and checks nothing, because the answer changes between the two moments and only the answer at start matters. An unresolved or invalid credential leaves the unit failed with every missing key named in the journal, and no value is ever printed. |
| #39554 | Added TLS certificate issuance to that ladder, at installation only: neither a service start nor a package upgrade re-examines, re-anchors or reissues a pair, because issuing one is a signature rather than a lookup. A pair replaced out of band therefore survives both untouched. What /etc/wazuh-manager/ca/ holds -- not a mode flag -- selects between minting the manager's own CA (only when nothing else is there), issuing from a CA staged with its key, keeping a pre-issued pair, and issuing nothing when the staged CA carries no private key, so a host never given a CA key cannot sign. The agent listener's pair (certs/remoted.pem) and the Server API's (certs/apid.pem) each get their own subject alternative names, from WAZUH_MANAGER_REMOTED_CERT_SANS and WAZUH_MANAGER_APID_CERT_SANS; when unset, the node name, its canonical name and the global-scope addresses of the default-route interfaces, plus loopback. A manager left without certificates is still caught before any daemon runs, by the configuration validator's (1244) verdict naming the file. |
| #39554 | Added the tooling the ladder needs: bin/rbac_control seed, wazuh-manager-keystore -g (prints a stored value and exits non-zero when the key is unset), bin/wazuh-manager-resolve-credentials --clear (removes what the resolver made and keeps what it was given, refused while a daemon runs, for an image whose postinst baked credentials into a layer every container would share), and USER_RESOLVE_CREDENTIALS in install.sh, set to n by both packaging recipes because they stage a tree they copy into the package. |
| #35905 | Added caller module context to indexer-connector logs. |
Changed
| Issue | Comment |
|---|---|
| #39923 | Renamed the Server API default user wazuh-wui (ID 2), the account the Wazuh dashboard backend authenticates with, to wazuh-internal-client, so it is no longer taken for a dashboard login. WAZUH_MANAGER_WUI_PASSWORD keeps its name. |
| #39554 | Changed the Server API default users so they no longer ship with a password: users.yaml carries none, and wazuh and wazuh-internal-client are seeded with the value supplied to the credential resolver or, failing that, with a freshly generated 32-character password per installation -- so two clean installations never share a credential, and a deployment that bypasses the resolver is still unique. An already-seeded rbac.db is never reseeded, so upgrades change no credential; rbac_control factory-reset now regenerates rather than restoring wazuh/wazuh. The start-up warning added in #38862 goes with the defaults it detected. |
| #39554 | Changed the manager to be installed neither enabled nor started, by the packages and by install.sh alike -- systemctl enable --now wazuh-manager is the documented step, because the manager needs credentials it cannot always resolve at install time and a unit enabled without being started only produces a failed unit at the next reboot. The install-time certificate NOTICE is gone with it, replaced by the resolver's own verdict at the moment it either issues the pair or reports that it could not. wazuh-manager-remoted and wazuh-manager-authd no longer end their TLS preflight errors with "wazuh-manager does not generate TLS certificates": the hint now points at ownership and mode, which is what that error almost always means. Removal follows the package manager for /etc/wazuh-manager, credentials included: a DEB remove and an RPM erase keep it, every file saved as *.save, and a DEB purge removes it with the service account. |
| #39554 | Changed wazuh-manager-apid to refuse to start when api/configuration/security/rbac.db is absent or empty, instead of creating it. Creating it there seeded the two default users with generated passwords published nowhere -- not to /etc/wazuh-manager/export/credentials.env, not to the log -- so the API came up and nobody could authenticate against it, with no record of the credential on the host. The database is the credential resolver's to create, through rbac_control seed, and wazuh-manager-control start resolves credentials before any daemon runs; error 2012 now names that step. rbac_control factory-reset still recreates it. |
| #39554 | Changed the Server API password rule to PCI DSS v4.0 requirement 8.3.6: 12 to 64 characters with at least one letter and one digit, from any printable ASCII except the space, no longer requiring both cases and a symbol -- it has to accept what rotation tools and other clients send. A value supplied to the credential resolver (the environment or /etc/wazuh-manager/local.env) is held to a stricter rule: the same 12 to 64 length, drawn only from A-Z a-z 0-9 . , _ + : @ % ^ = ~ -, with a lowercase letter, an uppercase letter, a digit and a symbol. That set is a subset of the API's and every class it requires satisfies the API's, so a value accepted at installation is never one the Server API rejects at rotation. Generated passwords meet both by construction. |
| #38842 | Changed the RBAC action required by GET /agents/{agent_id}/key from agent:read to the new agent:read_secrets action, so a role that can list agents no longer exports the pre-shared key needed to impersonate them. The new action applies to an rbac.db seeded from the defaults — a fresh installation or a rbac_control factory-reset; a database preserved across a package upgrade keeps the policies it already had, and on such a box the endpoint is denied for every role until the database is reseeded. The action lives in the secrets_read default policy next to cluster:read_secrets, so on a seeded database administrator is the only built-in role that can export an agent's key: agents_admin and wazuh_indexer_admin keep every other agent operation through agents_all but lose key export, as do readonly and agents_readonly. Provisioning does not change: POST /agents still returns the key of the agent it creates under agent:create, and minting an enrollment token is unchanged, so only re-reading an existing agent's key needs administrator. Every key read is now recorded as a secret_read audit line naming the caller and the agents served. Custom policies that grant agent:read must add agent:read_secrets explicitly to retain key export. |
| #38863 | Updated the bundled MITRE ATT&CK Enterprise dataset from v18.1 to v19.2 (new tactic TA0112 Defense Impairment, tactic TA0005 renamed to Stealth, 23 new and 17 revoked techniques). The database is generated at installation time; existing installations are not migrated. |
| #38816 | Replaced the manager's pseudo-XML configuration parser with a schema-validated strict-XML loader (shared_modules/manager_config): every consumer — the C daemons, the engine, the control script, the Python framework and the API — reads the same effective document; any daemon's -t and the new bin/wazuh-manager-conf validate|get|dump CLI validate the whole file (including the installed schema copy etc/wazuh-manager.schema.json) with JSON-pointer diagnostics (error 1244); GET /cluster/{node_id}/configuration serves the canonical schema shape with native types, and cluster.key becomes mandatory. Constructs the old parser tolerated (multiple roots, raw &, legacy comments, unknown options) are now rejected at startup — see the migration guide. |
| #33377 #33570 | Upgraded embedded Python interpreter from 3.10 to 3.12. |
| #30535 | Adapted Vulnerability Detector input pipeline to the new Wazuh 5.0 synchronization algorithm, covering first-scan, inventory-change, and feed-update scenarios. |
| #34608 | Removed legacy configuration surfaces, database schemas, build targets, and compatibility layers in the second server cleanup phase. |
| #35881 | Reduced wazuh-manager Debian package dependencies, removed adduser, lsb-release, debconf, and libc6. |
| #29734 | Upgraded external dependencies: curl, sqlite, xz, and libarchive. |
| #34479 | Implemented cooperative-cancellation graceful termination for wmodules. |
| #35478 | Preserved manager configuration files during package upgrades. |
| #35479 | Improved Wazuh server directory layout. |
| #35525 | Updated manager index names to align with the new sync model. |
| #36805 | Randomized the cluster key generated during manager installation instead of using a hardcoded default. |
| #36311 | Changed the default Indexer user used by the Manager from admin to the restricted wazuh-server user, aligning with the Indexer RBAC least-privilege model. |
| #36705 | Enabled shared-password agent enrollment by default, persisting the auto-generated authd.pass and synchronizing it to worker nodes, with fail-closed password validation. |
| #38091 | Raised the minimum TLS protocol version accepted by wazuh-manager-authd (agent enrollment) to TLS 1.3, removed the ssl_auto_negotiate fallback and its -a CLI flag, and changed <auth><ciphers> to a TLS 1.3 ciphersuite list. |
| #36453 | Increased the minimum API user password length from 8 to 12 characters to align with PCI DSS. |
| #38589 | Renamed the manager's log rotation and agent monitoring internal options from monitord.* to wazuh_modules.manager_task_*. An override left under an old name is silently ignored. Agents keep monitord.* for their own log rotation. |
| #38436 | Standardized the manager's Unix socket names and layout: every socket ends in .sock, carries an -http marker when it speaks HTTP, and lives in queue/sockets/. The sockets that were under queue/db/, queue/tasks/ and queue/cluster/ moved there, leaving those directories holding only their data. An upgraded installation keeps the old socket files as dead entries until a clean install. |
| #38862 | Disabled allow_run_as on the wazuh API default user. Authorization context login is only used by the dashboard, which authenticates as wazuh-internal-client; the wazuh account no longer resolves an authorization context into roles, and POST /security/user/authenticate/run_as answers it with the documented 403/6004. wazuh-internal-client is unchanged. The new value applies to an rbac.db seeded from the defaults — a fresh installation or a rbac_control factory-reset; a database preserved across a package upgrade keeps the flag it already had. A deployment that pointed the dashboard at wazuh with run_as enabled must either use wazuh-internal-client or re-enable the flag with PUT /security/users/1/run_as. |
| #38862 | Extended bin/rbac_control change-password so it can be driven without a terminal, which the installation password tools need: --user selects a single default user, --password-file reads that user's new password from the first line of a file (or from the standard input with -), and --passwords-file reads a JSON object mapping default usernames to their new passwords and applies all of them in one execution. Passwords are never accepted on the command line. With no option the command keeps prompting for each password, and it now exits non-zero when any requested change was not applied. |
| #39151 | Updated the embedded Python interpreter to 3.12.14 and refreshed its dependencies (aiohttp, cryptography, pip and setuptools). setuptools 84.0.0 no longer ships pkg_resources, removed upstream in 82.0.0, so google-cloud-storage was upgraded from 1.44.0 to 2.19.0 — the version it pinned imported that module and would have broken the gcloud bucket integration at import time. |
| #38992 | Changed the manager to stop generating its own TLS certificates: neither install.sh, the DEB/RPM scriptlets, wazuh-manager-remoted nor wazuh-manager-authd create remoted.pem/remoted-key.pem any more. The listener pair and the CA that signs it (root-ca.pem) are provisioned externally, with the Wazuh installation assistant (wazuh-certs-tool), and the manager fails closed without them: wazuh-manager-control start stops with (1244) … '/remote/https/certificate': file not found and a provisioning hint, and wazuh-manager-remoted refuses to start when the service user cannot read the files. |
| #38994 | Changed the default RBAC policy agents_read to include enrollment_token:read, so the roles that already read agents (readonly, agents_readonly) can list the enrollment tokens they were being refused. The listing never carries a credential; minting and removing still need agents_all. |
| #38993 | Changed the HTTPS agent API's 401 to name the authentication failure class: every credential failure keeps the generic message but carries WWW-Authenticate: Bearer error="invalid_token", error_description="<class>" and the same class as the body's code (a string on 401; other statuses keep the numeric status): unknown_agent (re-enroll), stale_token (fix the clock and retry), invalid_signature (do not re-enroll), invalid_request (no usable credential), token_unknown/token_expired/token_revoked and enrollment_key_unavailable on POST /enroll. The agent table of global.db gains the reenroll_secret column in the schema itself (no user_version bump and no upgrade step: 5.0.0 has not shipped, so a global.db created by an earlier development build lacks the column and must be recreated). The default RBAC policy agents_all gains enrollment_token:create/read/delete; an rbac.db created before this change keeps its previous policies, so administrators of such an installation get 403 on /agents/enrollment-tokens until the database is recreated or the actions are added. |
| #39053 | Changed the generation of the shared enrollment password (etc/authd.pass) to take 32 bytes straight from the CSPRNG (RAND_bytes) and hex-encode them to 64 lowercase characters, replacing a final MD5 digest that capped the result at 128 nominal bits however much entropy went into it. wazuh-manager-authd now refuses to start rather than write a weaker password if the CSPRNG fails, matching the agent key's fail-closed rule. Only newly generated passwords change: an existing etc/authd.pass is reused untouched, and a password supplied by an administrator is still accepted whatever its shape. |
| #40337 | Changed wazuh-manager-remoted and wazuh-manager-db to run without chroot, like the other manager daemons: service user wazuh-manager, root /, working directory the installation directory. wazuh-manager.service confines every daemon instead (ProtectSystem=full, ReadWritePaths limited to the installation directory and /etc/wazuh-manager, PrivateTmp, ProtectHome, ProtectKernelTunables, ProtectKernelModules, ProtectControlGroups), so an installation under /home, /root, /run/user or /tmp no longer runs under the unit. The remote.https TLS paths are opened as validated, relative to the installation directory or absolute. wazuh-manager-remoted now exits at start, naming the file, when the service user cannot read the CA it publishes on GET /cacerts (remote.https.ca_certificate) or, with client-certificate verification, remote.https.ca, as it already did for the certificate and the key. The installers no longer copy etc/localtime and etc/TIMEZONE into the installation directory and the framework uses the system time zone; wazuh-manager-db keeps SQLite's temporary files in tmp/ of the installation directory, and wazuh-manager-apid and wazuh-manager-clusterd run from that directory as well. |
| #40338 | Moved the manager configuration from /var/wazuh-manager/etc to a fixed /etc/wazuh-manager, with no symlink: a custom installation directory moves the installation only, and the generated configuration names the certificates by absolute path (a relative path written by the operator still resolves against the installation directory). /etc/wazuh-manager/certs is now root:wazuh-manager 0750 with every certificate and key root:wazuh-manager 0640, so no daemon can replace its own TLS material. A DEB purge removes both directories and the account; an RPM erase keeps the configuration as *.save and hands everything it keeps to root:root. The maintainer scripts and wazuh-manager-control now rely on shell builtins and coreutils only, the DEB package creates its account with groupadd/useradd, and the 4.x refusal also stops a fresh installation on a host that still carries a 4.x manager. |
| #40339 | Changed the credential resolver, bin/wazuh-manager-resolve-credentials, from a shell program to a single Python program on the manager's bundled interpreter, with the standard library, cryptography and PyYAML only, and no host tool. Each central package now owns its own directory under /etc and shares no file with the others: /etc/wazuh, the shared credentials.env and the downloaded wazuh-credentials.sh are gone. The manager mints and keeps its own CA in /etc/wazuh-manager/ca/, or uses one staged there, issues its server pairs from it, and publishes the CA certificate (never its key) and the Server API passwords in /etc/wazuh-manager/export/ for the dashboard. It imports the indexer's CA and a client pair the indexer issued for it, with clientAuth, from /etc/wazuh-indexer/export/ on the same host, taken together or not at all, or uses ones staged in certs/. Pairs may chain through intermediate CAs. The files checked are the ones the daemons are configured to serve (remote.https, auth, indexer.ssl and the Server API's api.yaml), which must be in /etc/wazuh-manager/certs. Every entry is opened without following links and checked for owner and mode, so the service account cannot plant or swap material in the group-writable configuration directory. wazuh-manager-control runs a read-only --check before validating the configuration and, on a restart, before stopping anything, then --prestart, which completes what it can and refuses the start on anything missing, invalid or unsafe, naming the file and the reason. The manager packages no longer depend on openssl, iproute2, hostname, gawk, util-linux, diffutils, grep, sed or findutils: the DEB declares libc6 (>= 2.18) and passwd, the RPM coreutils. The bundled interpreter takes zlib from libwazuhext like its other native dependencies, so neither package needs the host's zlib. |
| #33378 | Changed the Wazuh Manager installation path to /var/wazuh-manager (replacing /var/ossec) and removed agent ID 000, fully decoupling agent and manager processes on shared hosts. |
| #40684 | Changed the Server API login lockout to count failed attempts per client IP and user instead of per client IP, so failures for one user no longer block the others logging in from the same address, such as the dashboard on an all-in-one host. A client is still blocked for every user after ten times max_login_attempts failures across all of them. |
Removed
| Issue | Comment |
|---|---|
| #33124 | Removed Filebeat as the log-shipping component; event forwarding now uses native Wazuh server connectivity to the Wazuh Indexer via indexer-connector. |
| #30922 | Removed deprecated manager daemons: ossec-authd, wazuh-agentlessd, wazuh-maild, wazuh-dbd. |
| #30924 | Removed deprecated C CLI tools: manage_agents, agent-auth. |
| #31028 | Removed OpenSCAP server-side module. |
| #31299 | Removed inventory-related API endpoints. |
| #28425 | Removed legacy API security configuration endpoints. |
| #35908 | Removed SELinux integration from the manager. |
| #38024 | Removed the GET /agents/{agent_id}/stats/{component} API endpoint. Agent statistics are read from the wazuh-agent-stats index. |
| #38589 | Removed the wazuh-manager-monitord daemon, along with the monitor component of the active configuration endpoints, which its socket served. |
| #38589 | Removed the <global><agents_disconnection_alert_time> option. A configuration that still includes it fails to start. |
| #38992 | Removed the certificate-generation mode (-C, -B, -K, -X, -S) of wazuh-manager-remoted and wazuh-manager-authd, and the USER_CREATE_SSL_CERT and USER_GENERATE_AUTHD_CERT installation variables. |
| #39554 | Removed the built-in wazuh-manager/wazuh-manager indexer credential: the indexer connector no longer falls back to it when the keystore is empty, and queue/sockets/keystore.sock no longer answers the literal wazuh-manager for a key nobody set. Both made "not set" indistinguishable from "set to a password everyone knows"; an absent credential is now an error the resolver reports by name before any daemon starts. |
Fixed
| Issue | Comment |
|---|---|
| #31746 | Fixed Vulnerability Detector version matcher logic for improved detection accuracy. |
| #33108 | Fixed Cloudtrail log ingestion parsing errors. |
| #34082 | Fixed wazuh-manager-db error assigning groups by avoiding the keyentries counter as index. |
| #35043 | Fixed token validation race condition after revoke. |
| #35638 | Handled the stop signal during vulnerability feed download. |
| #38511 | Fixed world-writable permissions on bundled Python files after DEB installation, caused by the permission restoration script following symlinks. |
| #38589 | Fixed the agent disconnection sweep running on cluster workers, and fixed manager log files never rotating daily on a manager that was restarted every day. |
| #38547 | Fixed the API serving its OpenAPI specification and exact version at /openapi.json and /openapi.yaml without authentication. |
| #38565 | Bounded the search query parameter to 1024 characters across every endpoint that accepts it, fixed the API's wazuh-db socket client raising an unhandled error instead of a clean 500 when wazuh-db closes the connection on an oversized request, and stopped the API from returning wazuh-db's raw backend error text (including SQL fragments) to the caller. |
| #38626 | Fixed POST /agents/insert accepting an id outside the signed 32-bit range the manager stores it in, and authd's auto-assigned id counter wrapping to a negative id once it reached INT_MAX, both of which produced an agent record that could not be queried or deleted. A caller-supplied id is now rejected when it is out of range or equal to 0, and the id counter refuses to wrap, failing the enrollment instead. |
| #38695 | Fixed wazuh-manager-apid and wazuh-manager-clusterd killing their own freshly started process during an unclean-stop recovery, when the kernel reused a PID recorded in a stale .pid file for the new instance. clean_pid_files() now only terminates a process whose creation time predates the stale file, and never the caller's own PID. Also fixed delete_child_pids() matching a child's pidfile by PID substring, which let a child with PID 16 remove the pidfile of PID 161. |
| #38638 | Fixed PUT /groups/{group_id}/configuration accepting content with no XML elements at all (plain text or a comment-only body), which replaced a group's agent.conf without any error. Fixed PUT /cluster/{node_id}/configuration accepting a manager configuration with no <cluster> or no <indexer> section at all, which GET /cluster/configuration/validation also reported as valid but left wazuh-manager-clusterd (missing cluster.key, which has no default) or wazuh-manager-analysisd (zero indexer hosts) unable to start on restart. cluster and indexer are now mandatory top-level sections of the schema. |
| #38749 | Fixed install.sh silently repointing the host's wazuh-manager/wazuh-agent service to the directory being installed: an install into an alternative USER_DIR (a sandbox tree, or a package build root) now leaves an existing service definition that names a different directory untouched and warns, unless USER_TAKEOVER_SERVICE="y" is set. USER_REGISTER_SERVICE="n" skips the boot integration altogether. |
| #38810 | Fixed POST /security/user/authenticate/run_as returning a token with the service account's static administrator role when the authorization context was empty. An empty context is now resolved against the authorization rules like any other context instead of falling back to those static roles, so it yields a token with no roles under the default ruleset; a user without allow_run_as posting an empty context now gets the documented 403/6004 instead of a token; the API access log no longer raises on a body that is not an object, which turned the validator's 400 for a null, numeric or boolean body into an unhandled 500 on every endpoint; and the API specification now declares the text/plain response this endpoint returns with raw=true. |
| #38855 | Fixed the API access log writing secrets to api.log and api.json in cleartext. Redaction only ever tested the top-level keys of the request body for password, and for key only on /agents paths, so a secret one level down -- including in a body the API rejected with a 400, which is logged all the same -- was written out verbatim. The log now masks a set of sensitive field names (password, key, token, secret, credentials, authorization and their <prefix>_<name> forms) case-insensitively at any depth of the body and in the query string, and no longer writes the run_as authorization context at info level, where the hash_auth_context already on the line identifies it. The context is also hashed as received again, so the hash in the log matches the one stamped into the issued token. |
| #38874 | Fixed the API's request-rate limiter being a single global counter shared by every caller: it is now keyed per client address, with a separate, much smaller allowance for unauthenticated/failed-auth requests so they can no longer exhaust an authenticated caller's budget, and rate-limit exhaustion is now logged at WARNING naming the source address. Also fixed a request to a path or method outside the API's specification being billed to the authenticated allowance regardless of whether it carried any credential, since it never reaches the authentication step at all; it is now billed to the smaller, unauthenticated allowance like a genuine authentication failure. Also fixed an authenticated caller already over its per-minute ceiling still paying the full cost of authentication before being rejected; it is now rejected before authentication runs. |
| #38862 | Fixed bin/rbac_control change-password failing to change the password of every user it targets. update_user only lets a reserved user modify another reserved user's password and needs to be told who is asking, which the script never did, so each prompted password was reported as FAILED with error 5011 (Administrator users can only be modified by themselves). |
| #38633 | Fixed slow delivery of agent-groups assignments on worker nodes when the assignment reaches the worker before the group itself: the worker now retries the rejected assignment instead of waiting for the checksum mismatch limit. The transient rejection is no longer reported as an error while it is being retried, neither by wazuh-manager-db on the worker nor by the master node's synchronization log, and exhausting every retry is reported as a warning naming the affected agents. |
| #38713 | Fixed the vulnerability scanner deleting every finding of an agent's rpm and deb packages when a scan ran without the agent's OS major version or code name. The OS release reaches the scanner only in the OS inventory document a sync session carries alongside its packages, and nothing persisted it between sessions: without it the CNA column family was built from an unsubstituted $(MAJOR_VERSION) template (alas_), every package lookup threw, and the failure was indistinguishable from a clean scan -- so the reconciliation, which pre-loads existing findings as deletions, removed findings it had never evaluated. The Debian families failed the same way silently, through a code name comparison that could not succeed. A package the scanner could not evaluate now keeps its findings and is counted as not evaluated in the scan summary, and a first scan that arrives without a usable OS context no longer clears the agent's existing findings before scanning. |
| #38938 | Fixed API validation errors returning the jsonschema exception text, which embedded the internal schema as a Python dict literal and echoed the submitted value back: a rejected parameter now names itself and the constraint it violated. Bounded offset at 2147483647, so an out-of-range value is rejected by the specification instead of by wazuh-manager-db, and a request for a cluster node the cluster does not have now answers 404 instead of 200 with the node reported as a failed item. |
| #39113 | Fixed get_indexer_client() raising AttributeError: 'str' object has no attribute 'get' when reading indexer.ssl.certificate_authorities, certificate, and key from the manager configuration, which kept the indexer task manager from ever starting disconnected_agent_sync, active_response_task, and metrics_snapshot on a manager with a correctly configured indexer. The reader still expected the shape the old pseudo-XML parser produced; it now matches the shape the schema-validated configuration loader returns. Also fixed the same function requiring certificate, key, and certificate_authorities to be present, when the configuration schema documents all three as optional (client certificate and CA pinning are opt-in; the indexer connection otherwise falls back to basic auth over the system trust store) and the manager's own C++ indexer connector already treats them that way. Also fixed the SSL context only trusting the first entry of certificate_authorities, silently ignoring the rest; the C++ indexer connector already merges every configured CA into the trust store, which the Python client now does too, so a CA rotation with both the old and new CA listed no longer breaks the connection as soon as the indexer presents a certificate signed by the second one. Also fixed a bad certificate/key/CA path escaping as a raw FileNotFoundError instead of an IndexerUnavailableError naming the SSL context as the failure point. Also fixed a blank entry in certificate_authorities being silently dropped instead of rejected, which could mask a misconfigured CA behind an apparently working connection using the remaining entries. |
| #39114 | Fixed wazuh-manager-control failing to reclaim start-script-lock when it was left behind without its pid file, which happens when the owning process dies between creating the lock directory and recording its pid in it. start and status failed indefinitely with Another instance is locking this process until the directory was removed by hand; a lock left with no pid file is now treated as stale and reclaimed, the same as one whose recorded pid no longer exists. Also fixed wazuh-manager-control status reporting wazuh-manager-authd as not running, and exiting non-zero, on a manager with auth.disabled set to true, where start deliberately does not launch it; container healthchecks built on status restart-looped such a manager. |
| #38906 | Fixed the indexer health monitor taking a node out of rotation when its GET /_cat/health probe got an HTTP 429 (for example a tripped parent circuit breaker). Every consumer of the indexer connector then stopped sending for at least one probe interval: the engine's event queue filled and could discard events, and inventory-sync answered agents 503 and failed bulk flushes with No available server, although the node was alive and only asking for less load. A 429 now marks the node as throttled: it stays in rotation and each request backs off on its own 429s; only a transport failure, 401/403, any other 4xx, a 5xx or a red cluster mark it unavailable. With several nodes, the selector prefers an available node over a throttled one. The log names the cause (HTTP 429 circuit_breaking_exception: …) instead of Client error, warns when the breaker reports PERMANENT durability, and logs both transitions once. The first retry of the connector's backoff now waits a random time between the base delay and 1.5 times it, so connectors rejected in the same instant no longer retry in lockstep. The vulnerability scanner still refuses an agent's rescan request with 503 indexer_unavailable while every host is throttled, so the agent keeps the request pending instead of having it dead-lettered by a long throttle. |
Agent
Added
| Issue | Comment |
|---|---|
| #29533 #31838 | Added local state persistence for agent modules (FIM, System Inventory, SCA), removing the dependency on rsync with the Wazuh Server and reducing network traffic and server-side processing overhead. |
| #37828 #37830 #37832 #37833 #37834 #37835 #37836 | Added an agent HTTPS client covering the /control lifecycle, the /stateless and /stateful data planes, /download for centralized configuration and WPK packages, task dispatch with durable deduplication, and remote upgrade, with AES-CMAC request signing and fail-closed TLS validation. |
| #32152 | Added the agent_info module, the agent's single source of truth for its own metadata (id, name, version, OS, groups, cluster), persisted locally and attached to every module's events. |
| #37843 | Added periodic /stats and /config push, reporting every module's statistics and configuration in a single aggregated document per endpoint, behind two ossec.conf toggles that are off by default. |
| #40125 | Added an active response allowlist; responses never target the manager or loopback. |
| #39064 | Agents now re-enroll with a per-agent secret stored at etc/reenroll.secret, keeping their agent id. |
| #39064 | An agent re-enrolls only when the manager reports that it no longer knows the agent; every other authentication failure is retried with the credential the agent already holds. |
| #39064 | An enrollment token the manager refuses is now logged with its token id, so operators know which one to re-mint. |
| #39064 | An agent keeps its enrollment token when the manager reports only that enrollment is disabled. |
| #39064 | An agent whose re-enrollment secret the manager refuses falls back to the configured credential, so a rebuilt manager does not require visiting every endpoint. |
| #39407 | Added Enroll and Update CA actions to the Windows agent tray GUI (win32ui), enrolling or refreshing the trust anchor from a pasted token. |
| #40349 | Added the wazuh_modules.socket_timeout internal option (default 1 s), bounding how long a local client of wazuh-modulesd can stay silent while sending its request or reading the reply. |
| #37844 | The FIM synchronization queue flush batch size, flush interval and WAL auto-checkpoint threshold can now be set through internal options; the defaults are unchanged. |
Changed
| Issue | Comment |
|---|---|
| #38465 | Changed agent enrollment to consume the manager's HTTPS POST /enroll endpoint instead of the legacy A:/K: protocol over TCP/1515, reusing the same <agent><ssl>/<agent><server> transport as the rest of the agent's HTTPS traffic. |
| #38624 | Changed the WAZUH_MANAGER_ENDPOINT installation variable to carry the whole connection target — host[:port][/prefix], with only the address mandatory — which the DEB/RPM, source and MSI installers write verbatim into the agent's single <endpoint> setting. It supersedes WAZUH_MANAGER and WAZUH_MANAGER_PORT when set, and those keep working unchanged when it is not. A trailing slash (host/) opts out of the reverse-proxy prefix. Replaces the variable's previous prefix-only meaning. |
| #34849 | Changed Vulnerability Detection to use the Wazuh Indexer as the sole authoritative CVE data source, removing direct CTI network access from the agent-side Vulnerability Detector. |
| #33199 | Adjusted agent-side Vulnerability Detector inventory emission and synchronization (OS, packages, hotfixes) to align with the updated VD behavior in Wazuh 5.0. |
| #31478 | Simplified rootcheck: removed the server-side database, sync path, and API surface; findings are now indexed through the standard alert pipeline. |
| #38589 | Changed the shared log-rotation helper so a rotation whose target directory cannot be created is reported and skipped instead of terminating the daemon. This also applies to the agent's own log rotation, which previously exited on that error and was restarted by the service manager. |
| #33382 | Updated logcollector file-tailing initial read strategy for more consistent behavior across log rotation scenarios. |
| #34462 | Updated Windows Event Channel log collection to emit native XML from EvtRender() without an XML declaration header. |
| #35330 | Increased default limits for agent event throughput and inventory message sizes. |
| #35880 | Reduced wazuh-agent Debian package dependencies, removed adduser, lsb-release, and debconf. |
| #35471 | Standardized agent-start and buffer-status events to a WCS-aligned JSON format. |
| #39274 | Extended the Windows agent's default FIM registry ignore list to exclude the OS telemetry under HKLM\System\CurrentControlSet\Services. |
| #39064 | The 5.0 package upgrade deletes etc/authd.pass from the endpoint. Operators who rotate it should know it disappears at upgrade. |
| #39064 | A fresh 5.0 install no longer creates etc/authd.pass. |
| #39064 | WAZUH_REGISTRATION_PASSWORD is no longer used; the installer logs that it was ignored. |
| #39064 | An enrollment password stored outside the default path is left in place. |
| #39064 | The installers no longer add an <authorization_pass_path> element naming the default password file. |
| #39064 | An agent enrolled before the upgrade keeps working on its existing key, but must be re-pointed with an enrollment token to obtain a re-enrollment secret. |
| #39406 | Changed the Windows agent tray GUI (win32ui) to display the manager address and enrollment key read-only, removing the Save button and its unverified write path. |
| #40120 | Renamed the Windows agent Start menu folder from OSSEC to Wazuh and the agent GUI shortcut from Manage Agent to Wazuh Agent Manager. |
| #40120 | Upgrades remove the agent shortcuts left in the legacy OSSEC Start menu folder, and the folder itself when nothing else is left in it. |
| #40121 | The Windows agent GUI shows (no manager configured) instead of a placeholder or empty endpoint. |
| #40121 | With no manager configured, Manage > Start and Restart in the Windows agent GUI report "check config" instead of starting an agent that exits at once. |
| #40121 | The Windows installer's no-token message points to Manage > Enroll in the agent GUI or to wazuh-agent-auth.exe. |
| #40121 | Windows installer lines in ossec.log use the agent's yyyy/mm/dd hh:mm:ss timestamp. |
| #40681 | The deb, rpm and macOS installers' no-token message ends with the wazuh-agent-auth command that enrolls the agent, and an agent that refuses to start because it was never enrolled says how to enroll it, with (4128). |
| #40349 | Changed the AWS module to pass inline access_key/secret_key to its script through the environment instead of the command line. |
| #40531 | Aligned host.os.kernel, host.os.display_version and host.os.full in the syscollector system inventory with the inventory schema. |
Removed
| Issue | Comment |
|---|---|
| #30435 | Removed deprecated agent binaries and legacy modules as part of the Wazuh 5.0 agent cleanup. |
| #31582 | Removed NSIS-based Windows agent installer; Windows agent now ships exclusively as an MSI package. |
| #38091 | Removed the <enrollment><auto_method> option; enrollment now always requires TLS 1.3, so there is nothing left for it to negotiate down to. The ssl_cipher option now expects a TLS 1.3 ciphersuite list instead of an OpenSSL cipher-list string. |
| #38465 | Removed the <enrollment> manager_address, port, interface_index, ssl_cipher, server_certificate_path, agent_certificate_path, and agent_key_path options; enrollment now always targets the same manager and TLS configuration as the rest of the agent's HTTPS traffic. A 4.x ossec.conf carrying them still parses without error after an in-place upgrade. |
| #39674 | Deprecated the 4.x FIM, Syscollector, SCA and agent options that no longer have any effect; an upgraded ossec.conf that still sets them loads with a deprecation warning. |
| #38600 | Removed the default netstat and last command monitoring entries, which depend on binaries not present on every supported platform (e.g. minimal container images), causing repeated failed executions every frequency cycle. |
| #39279 | Removed the default df -P command monitoring entry, which reported disk usage/capacity with no security relevance every frequency cycle. Also removed the stale df -P, netstat, and last entries from etc/ossec-agent.conf, the fallback configuration installed by install.sh when template generation fails on a source install. |
Fixed
| Issue | Comment |
|---|---|
| #40349 | Fixed wazuh-modulesd waiting indefinitely on a command that ignored its timeout; the command's process group is now stopped after wazuh_modules.kill_timeout. |
| #40349 | Fixed the Office 365 and GitHub modules skipping the rest of a collection window after a response larger than curl_max_size; only that response is now skipped, with a warning. |
| #40349 | Fixed the AWS and GCP modules stopping when a command could not be run. |
| #40349 | Fixed the agent upgrade reporting an installer that timed out as dispatched. |
| #40114 | Fixed RPM agent removal leaving the agent key and re-enrollment secret behind. |
| #39991 | Fixed agent daemons using up to 2x memory on aarch64 with glibc 2.43. |
| #29668 | Fixed FIM checksum calculation that was incorrectly ignoring some file fields. |
| #30513 | Fixed syscollector reporting duplicate and bogus packages on macOS arm64. |
| #32915 | Fixed agent_control not displaying agent status information. |
| #35071 | Fixed SCA handling of invalid operators and missing values in regex patterns. |
| #35162 | Fixed FIM inventory reporting file modification time as 1970-01-01. |
| #35169 | Fixed agent automatic reload failing after receiving centralized configuration. |
| #35248 | Fixed syscollector false positive package detection on macOS. |
| #35329 | Fixed agent uninstall on Windows after a WPK upgrade. |
| #35955 | Fixed wodle command argument construction for Windows paths. |
| #35960 | Prevented Windows agent restart abort when the service is already stopping. |
| #35978 | Fixed timeout message displayed after a 4.13-to-5.0 upgrade on Windows. |
| #35979 | Fixed agent disconnection on direct 4.13-to-5.0 custom WPK upgrade. |
| #35988 | Excluded /bin and /sbin from FIM monitored directories on usrmerge distributions. |
| #36002 | Expanded Windows environment variables in SCA rule inputs. |
| #36061 | Made sync_end_delay interruptible to remove stale modulesd.pid after agent stop. |
| #36092 | Honored the shutdown signal in agent-upgrade StartMQ to avoid timeout warning on agent stop. |
| #36126 | Adjusted DockerListener messages as log entries to fix event categorization. |
| #36134 | Dropped orphan paths before promoting on agent startup to fix FIM. |
| #38825 | Fixed the agent stopping every timer-driven message for the duration of a backward system-clock jump. |
| #37653 | Lowered the wazuh-agentd connection socket error log to debug level to avoid duplicating the "Lost connection with manager" error on transient disconnections. |
| #37626 | Fixed a race condition when saving the Logcollector file status on shutdown. |
| #37656 | Fixed an unbounded memory leak in wazuh-modulesd caused by a missing RPM macro context cleanup on every package scan cycle. |
| #37993 | Fixed wazuh-syscheckd failing the file_entry.checksum NOT NULL constraint when the deferred sync-flag update ran for an entry deleted during the scan. |
| #37993 | Fixed wazuh-syscheckd failure on shutdown, which logged "Invalid handle value", crashed the process and left a stale PID file. |
| #38065 | Fixed SCA and Syscollector sync threads not blocking SIGTERM, which could cause the shutdown handler to run on a module thread instead of the main thread and time out joining it. |
| #38212 | Fixed the Windows agent leaving the FIM synchronization database open when the service stopped, which left the queue\ directory behind after an uninstall without purge. |
| #38646 | Fixed SCA HIPAA compliance mappings across policy checks. |
| #38736 | Fixed two CIS Amazon Linux 2023 SCA checks (gpgcheck, vsftpd) reporting false-positives on compliant systems. |
| #38829 | Fixed Coverity findings across agent components (syscheckd, sca, agent-info, https_client, agent-upgrade, and shared). |
| #38850 | Fixed missing <manager> block on Debian 10 unattended DEB installs. |
| #39162 | Fixed the macOS agent package installing the Linux SCA policy on newer macOS releases. |
| #38975 | Fixed SCA PCI-DSS compliance mappings, updated from v3.2.1 to v4.0 numbering. |
| #38928 | Fixed the CIS Amazon Linux 2023 SCA policy: check 31170 was named for the GID 0 default group control it does not test (its rule actually tests the root password), and check 31172 was a byte-identical duplicate of 31171, both testing /etc/passwd permissions and inflating compliance scores. |
| #38914 | Fixed the default agent nodiff list not protecting /etc/shadow and real key paths. |
| #39309 | Fixed SCA HIPAA compliance values using parenthesized notation, which the dashboard's Regulatory Compliance catalogue doesn't recognize; converted to the dotted notation the catalogue expects. |
| #39514 | Fixed SCA ISO 27001 compliance mappings, remapped from the superseded 2013 numbering to 2022 Annex A. |
| #39192 | Fixed the block-ip active response not blocking IPs on a default macOS install. |
| #39667 | Fixed azure-logs logging a collection whose Python script failed as finished: a non-zero exit code is now reported as a warning, the script output that is not in its log format (e.g. a Python traceback) is logged as an error, also after a timeout, and the request, container and domain are logged as failed instead of finished. A script that cannot be executed, e.g. because python3 is missing, is now reported and no longer stops the module. |
| #39869 | Fixed FIM scan hanging when a monitored file is replaced by a FIFO. |
| #39998 | Fixed the Debian 13 SCA policy reusing the Debian 12 check IDs, renumbering it to a dedicated 42000+ range. |
| #40307 | Fixed MITRE ATT&CK mappings across 64 SCA policies: removed Windows-only and cloud-only techniques from Linux and macOS checks, removed the reconnaissance technique T1595 from all of them, updated revoked technique IDs to their current successors, and added missing parent techniques. |
| #40413 | Fixed a stray trailing period in the /etc/crontab permissions remediation, duplicated across 25 SCA policies, and restored a missing command in the gfs2 kernel module remediation example in the CIS Ubuntu 24.04 and 26.04 policies. |
| #40706 | Fixed Logcollector losing lines after an in-place file truncation. |
| #40433 | Fixed generic MITRE ATT&CK technique bundles reused across 3,158 unrelated SCA checks in 69 policies, replacing them with mappings based on what each check controls. |
| #40571 | Fixed SCA remediation text stored as flattened single-line prose, which collapsed lists, warnings, and multi-step commands into one run-on sentence; converted all 11,258 remediation fields across all 72 SCA policies to structured Markdown (lists, bold, fenced code blocks), matching the dashboard's new Markdown renderer for the SCA Check Details view. |
| #40709 | Fixed Windows per-user packages, such as Microsoft Store apps and OneDrive, being reported as uninstalled while their user is not logged on. |