GitHub Release: wazuh/wazuh v4.14.10-rc1 (21.10.2026)

What's Changed

• Bump 4.14.10 branch by @wazuhci in #39241


• Stop buffering request bodies before authentication in the API access logger by @jotacarma90 in #39403


• Merge 4.14.9 into 4.14.10 by @jotacarma90 in #39442


• Add macOS support to disable-account, which silently failed on every Darwin endpoint by @hernanvalenzuela in #39463


• Report password expiration date and max change interval on macOS by @rjcausarano in #39466


• Report the actual Windows release and build in the OS inventory after an in-place upgrade by @nbertoldo in #39547


• Re-enable FIM whodata integration tests in the Linux and Windows agent workflows by @MAnDumu in #39582


• Merge 4.14.9 into 4.14.10 by @jotacarma90 in #39605


• Mask sensitive values in the per-agent active configuration endpoint by @jotacarma90 in #39609


• Do not follow symbolic links when compressing a file into a gzip archive by @Miguevrgo in #39476


• Detect promiscuous interfaces in rootcheck without invoking a shell by @nbertoldo in #39622


• Fix heap buffer underflow when the GCP wodle output has empty log segments by @Darioortegaleyva in #39606


• Apply the centralized force_reconnect_interval on agent hot reload without a restart by @Darioortegaleyva in #39573


• Fix size read/write in FIM diff generation by @MAnDumu in #39619


• Capture the macOS ULS timestamp only from long enough lines by @Miguevrgo in #39327


• Validate the path and index field types in the wazuh-db FIM save2 handler by @jotacarma90 in #39709


• Resolve Coverity copy-instead-of-move findings in sudoers alias parser by @Darioortegaleyva in #39629


• Backport the whodata symlink path-resolution fix to 4.14.10 by @Darioortegaleyva in #39736


• Fix wazuh-syscheckd segfault on first scan when inotify cannot be initialized by @Darioortegaleyva in #39707


• Remove duplicated CR in print_out on Windows by @Miguevrgo in #39662


• Correct osd handling in parse_agent_update_msg (4.14.10) by @jepalfer in #39614


• Resolve logcollector monitored paths one component at a time and check each entry before reading it by @lchico in #39649


• Apply the configuration permissions to the shared directory by @Nicogp in #39734


• opasswd.old check Fix in Multiple SCA files by @IsExec in #39762


• Remove agent leftovers on Solaris 10 and AIX package removal by @Miguevrgo in #39807


• SCA: two checks in cis_debian10.yml are logically inverted since the 4.10.0 policy rewrite by @IsExec in #39768


• Fix MTA check in multiple SCA files by @IsExec in #39771


• Extend configuration masking to credential fields and group files by @ignaciogalle12git in #39706


• Match XML tags with whitespace or attributes when masking config by @jepalfer in #39663


• Fix run_as authorization-context regex not requiring a full match on $-anchored expressions by @MiguelazoDS in #39770


• Merge 4.14.9 into 4.14.10 by @jotacarma90 in #39843


• Bound the memory logcollector uses when reading a very long line with multi-line-regex by @cborla in #39800


• Validate agent names in delete_diff by @jepalfer in #39723


• Rehash legacy password hashes by @Antoniogm03 in #39664


• Stop the macOS ULS reader once logcollector shutdown starts by @Miguevrgo in #39748


• Harden Windows network-path detection to treat forward slashes as separators by @nbertoldo in #39796


• Read only regular files of bounded size from user profiles in the browser extensions inventory by @cborla in #39802


• Keep syscollector process and port inventory complete when a collected name is not valid UTF-8 by @Darioortegaleyva in #39956


• Read only regular, bounded-size metadata files in the PyPI and npm package inventory by @anromerom in #39860


• Fix one-byte buffer overflows in whodata, SQL log readers and FIM config by @Darioortegaleyva in #39705


• Refresh deb amd64 agent checkfiles sizes for 4.14.10 by @rjcausarano in #40004


• Keep the browser extensions inventory complete when extension metadata files contain unexpected values by @rjcausarano in #39931


• Check each junction and symbolic link on a Windows logcollector monitored path before reading through it by @lchico in #39781


• Update SCA ID for Debian 13 by @IsExec in #39995


• Widen the multigroup group_hash to a 32-character SHA-256 prefix by @Antoniogm03 in #39773


• Fix macOS source upgrade creating a second agent instead of updating a pre-4.14.9 package install by @rjcausarano in #40005


• Read Linux users' last login from lastlog and lastlog2, and count btmp failures since it, instead of reporting only open sessions and a hardcoded zero by @anromerom in #39728


• Harden how active responses and execd write the active-response log by @cborla in #40017


• Improve merged file handling by @jr0me in #39792


• Fix users inventory dropping the sudo role when a later sudoers rule excludes the user by @anromerom in #40081


• Fix malformed regex rules and per-item matching in run_as authorization-context rules by @MiguelazoDS in #39855


• Multiple SCA checks fix by @IsExec in #40102


• Fix host-deny active response removing unrelated hosts.deny entries via substring match by @Darioortegaleyva in #39905


• Refresh deb amd64 checkfiles sizes of four active-response binaries that grew a page on 4.14.10 by @rjcausarano in #40139


• feat(remoted): report TCP connections not yet tied to an agent by @MiguelazoDS in #39799


• Open report_changes snapshots through the vetted path walk by @Miguevrgo in #40110


• Resolve netsh.exe, route.exe and reg.exe from the system directory instead of searching PATH by @hernanvalenzuela in #39946


• fix(gcp): raise Cloud Storage log rules above alert threshold by @AwwalQuan in #40154


• fix(analysisd): reject unsafe hostnames in doDiff's diff path by @MiguelazoDS in #40132


• Hash the bytes logcollector reads so restarts do not resend files with NUL bytes by @anromerom in #40134


• Resolve the manager hostname in wazuh-agentd only after daemonizing, so it no longer crashes at startup on macOS 26 by @rjcausarano in #40133


• Extend the vetted logcollector path walk to AIX 6.1, HP-UX and Solaris 10, and close the in-place junction toggle race on Windows by @lchico in #40019


• Stop buffering and JSON-deserialising request bodies before authentication (4.14.10) by @jepalfer in #39744


• disable force by default in POST /agents when the force object omits enabled by @Antoniogm03 in #40158


• Quote numeric strings in wazuh-db list parameters by @Antoniogm03 in #40161


• Wait for the real readiness signal in flaky authd integration tests by @Antoniogm03 in #39922


• Remove the Solaris keepalive and socket timeout warnings and bound blocked TCP send and handshake receive on Solaris 10 agents by @lchico in #40103


• Stop Solaris 11 SPARC agent daemons from aborting on C++ exceptions by loading a single libgcc_s by @lchico in #40140


• Fix auditd decoders taking the wrong key and over-capturing res on combined events by @anromerom in #40196


• Keep the API login attempt window fixed from the first attempt by @Antoniogm03 in #40232


• Merge 4.14.9 into 4.14.10 by @TomasTurina in #40267


• Redact the Authorization header before request headers are written to the debug2 log by @jepalfer in #40233


• Fix memory-safety, authorization, and wodle/integration input-handling issues in manager components by @MiguelazoDS in #40010


• Prevent the Windows syscollector from reaching network paths read from user registry hives by @Darioortegaleyva in #40113


• Harden how the macOS installer trusts the /tmp/wazuh_envs deployment variables file by @fcontrerasc in #40248


• Bound the Solaris 10 agent receive loop with poll() when SO_RCVTIMEO is unsupported by @lchico in #40247


• Limit rule tree growth during ruleset loading in wazuh-analysisd by @matigarciadev in #40182


• Fix macOS syscollector users inventory leaking OpenDirectory queries and Mach ports by @Darioortegaleyva in #40327


• Resolve Coverity auto-copy finding in the syscheckd eBPF whodata name lookup by @lchico in #40330


• Fix duplicated Azure Storage events from hourly append blobs by @MAnDumu in #40177


• Move the rejection sample id instead of copying it in the indexer connector by @jotacarma90 in #40318


• Remoted flaky tests by @jepalfer in #40160


• fix(analysisd): load logtest config before the getconfig socket starts by @MiguelazoDS in #40273


• Keep the shared modules socket client reconnecting after a half-closed or reset peer by @ignaciogalle12git in #40234


• Lru cache cancels permission check by @jepalfer in #40181


• Fix the vulnerability outbox queue stalling and the stale findings left by re-scans by @Antoniogm03 in #40054


• Skip systemd not-found placeholder units in the services inventory by @hernanvalenzuela in #40344


• Fix wazuh-modulesd crash on malformed legacy Berkeley DB RPM package headers by @lchico in #40368


• Fix the CentOS 5 legacy agent build broken by O_CLOEXEC in data_provider by @cborla in #40390


• Refresh stale wodle and internal_options sizes in the Linux agent checkfiles baselines by @cborla in #40386


• Stop leaving an empty ossec-DD.json.gz after install or upgrade with JSON logging off by @nbertoldo in #40389


• Log a child process that already exited at debug level when stopping wazuh-apid and wazuh-clusterd by @jotacarma90 in #40364


• Stop masking http-request download failures in make deps (4.14.10) by @Darioortegaleyva in #40365


• fix(monitord): compress rotated archive and alert logs when they roll over more than once a day by @MiguelazoDS in #40148


• Encode the pipe and backslash of the URL sent by wurl_request by @Antoniogm03 in #40357


• Build wazuh-keystore with the Linux hardening flags by @Antoniogm03 in #40240


• Keep logcollector read positions when the status file is large and stop resending UTF-16 files on restart by @anromerom in #40392


• Backport the AWS late-arrival marker to 4.14 and keep its window in the database by @cborla in #40428


• Report the RHEL base release as the operating system version on RHCOS nodes by @nbertoldo in #40426


• Remove obsolete authd timeout_seconds and timeout_microseconds options by @jepalfer in #40340


• Keep AWS integration tests within the credential lifetime by not re-running the suite per module by @Darioortegaleyva in #40407


• Add a directory depth limit to the rootcheck system scan by @Darioortegaleyva in #40459


• Validate agent upgrade write chunks and escape rsync no_data range filter by @hernanvalenzuela in #40379


• Fix snort-full alerts split per line on Unix and sent without the alert on Windows by @Darioortegaleyva in #40056


• Delimit macOS Unified Logging events by their JSON structure by @Darioortegaleyva in #40387


• Check file type on the opened descriptor in content checks by @Nicogp in #40490


• Fix whodata device path buffer sizing on Windows by @hernanvalenzuela in #40470


• Apply the logcollector remote_commands setting to socket outputs in the centralized configuration by @cborla in #40477


• Close local request clients and route sync messages by header by @nbertoldo in #40472


• Report the old name on FIM eBPF whodata renames and read the 6.18 renamedata layout by @Miguevrgo in #40452


• Return ISO8601 input unchanged in timestampToISO8601 and make its test timezone independent by @Antoniogm03 in #40453


• Fix flaky AWS custom bucket test by sending the S3 notification to the queue directly by @Darioortegaleyva in #40405


• Restore the FIM warning for file names that are not valid UTF-8 by @Darioortegaleyva in #40513


• Remove the Audit plugin configuration when who-data is not enabled by @Miguevrgo in #38763


• Bump 4.14.10 branch by @wazuhci in #40549

Full Changelog: v4.14.9...v4.14.10-rc1