[v5.0.0] Manager Added Issue Comment #37702 Added HTTPS communication between Wazuh agents and the manager: a new HTTPS transport, protocol, and control plane (connection, configuration, statistics, task dispatch, remote upgrade, and event ingestion) replacing the legacy MQ/DGRAM-based agent-manager protocol end to end. #29585 Added the Wazuh Engine as wazuh-manager-analysisd, replacing the 4.x an…
What's Changed Use the package CNA source in solved vulnerability alerts by @Antoniogm03 in #40668 Keep OpenSSL cleanup out of exit() so wazuh-agentd stop leaves no stale pid file by @lchico in #40760 Retry postponed vulnerability scanner events without a dispatcher warning by @jotacarma90 in #40732 fix(gcloud): keep non-ASCII text unescaped in Pub/Sub events by @MiguelazoDS in #40776 Keep the HP-…
What's Changed Bump 4.14.10 branch by @wazuhci in #39241 Stop buffering request bodies before authentication in the API access logger by @jotacarma90 in #39403 Merge 4.14.9 into 4.14.10 by @jotacarma90 in #39442 Add macOS support to disable-account, which silently failed on every Darwin endpoint by @hernanvalenzuela in #39463 Report password expiration date and max change interval on macOS by @rjc…
Manager Changed Added the missing compiler hardening flags (stack canary, PIE, full RELRO and FORTIFY_SOURCE) to the Linux binaries. (#38571) The API access log no longer writes the run_as authorization context verbatim unless debug logging is enabled; hash_auth_context still identifies it. (#39471) Fixed Fixed the vulnerability scanner stalling while the CTI feed applies a backlog of offsets, by…
What's Changed Bump 4.14.9 branch by @wazuhci in #38210 Merge 4.14.8 into 4.14.9 by @jotacarma90 in #38257 Reject symlinks when writing files staged under the incoming directory by @cborla in #38267 Windows agent: safer MSI upgrade under a pending system restart by @vikman90 in #38277 Merge 4.14.8 into 4.14.9 by @jotacarma90 in #38387 Prevent the agent from stopping Active Response when too many c…
[v5.0.0] Manager Added Issue Comment #38260 Added HTTPS communication between Wazuh agents and the manager: a new HTTPS transport, protocol, and control plane (connection, configuration, statistics, task dispatch, remote upgrade, and event ingestion) replacing the legacy MQ/DGRAM-based agent-manager protocol end to end. #31295 Added cluster-by-default deployment model: all Wazuh Server installatio…
What's Changed Bump 4.14.9 branch by @wazuhci in #38210 Merge 4.14.8 into 4.14.9 by @jotacarma90 in #38257 Reject symlinks when writing files staged under the incoming directory by @cborla in #38267 Windows agent: safer MSI upgrade under a pending system restart by @vikman90 in #38277 Merge 4.14.8 into 4.14.9 by @jotacarma90 in #38387 Prevent the agent from stopping Active Response when too many c…
Manager Fixed Fixed AES connection getting reset to blowfish on keystore rebuild. (#37524) Fixed a deadlock in wazuh-analysisd that stopped alert generation when the Active Response queue filled up. (#37764) Restricted the upgrade commands accepted from the agent message channel in Analysisd. (#37745) Added destination path validation when deleting rule and decoder files. (#37838) Added source pat…
What's Changed Bump 4.14.8 branch by @wazuhci in #37404 Multi SCA, Decoder and Rule fixes by @Johnng007 in #37434 Maintain crypto_method on keystore rebuild by @jpcerrone in #37524 Merge 4.14.7 into 4.14.8 by @vikman90 in #37679 Fix RBAC permission bypass in GET /security/actions and /security/resources by @vikman90 in #37678 Validate destination paths when uploading list, rule, and decoder files…
Merge pull request #39313 from wazuh/fix/39170-macos-logged-in-users-…
Manager Fixed Hardened RSA decryption to reject malformed ciphertext blobs. (#36243) Improved cluster merged file parameter validation to prevent directory escape. (#38375) Improved tmp_file path validation in cluster DAPI. (#38376) Improved cluster non-merged file path validation during worker file processing. (#38377) Improved cluster worker file path validation. (#38378) Improved destination pa…
What's Changed Bump 4.14.8 branch by @wazuhci in #37404 Multi SCA, Decoder and Rule fixes by @Johnng007 in #37434 Maintain crypto_method on keystore rebuild by @jpcerrone in #37524 Merge 4.14.7 into 4.14.8 by @vikman90 in #37679 Fix RBAC permission bypass in GET /security/actions and /security/resources by @vikman90 in #37678 Validate destination paths when uploading list, rule, and decoder files…
What's Changed fix(ci): correct S3 artifact run directory layout for 4.14.7 by @jr0me in #37377 Lower log level of transient cluster failures by @ignaciogalle12git in #37338 Fix github actions shell by @Miguevrgo in #37355 SCA Policy Adjustments by @Johnng007 in #37385 Bump 4.14.8 branch by @wazuhci in #37404 fix(ci): grant OIDC to Coverity S3 jobs by @jr0me in #37406 Remove unnused assignment for…
What's Changed Bump version to 4.10.5 r41050 by @jotacarma90 in #36313 Add missing 4.8.2 entry to packages changelogs by @jotacarma90 in #36406 Stabilize indexer_connector and keystore unit tests for 4.10.5 by @jotacarma90 in #36734 Improve cluster merged file parameter validation by @vikman90 in #38375 Improve tmp_file path validation in cluster DAPI by @vikman90 in #38376 Cluster file processing…
Merge pull request #38254 from wazuh/fix/38194-aws-it-concurrent-runs…
Merge pull request #38460 from wazuh/enhancement/38139-sccache-and-gh…
Building curl with --with-openssl only changes the product if the agent build actually compiles curl, and it does not: make deps pulls a precompiled archive and the CMake short-circuits on it, which is the path 5_builderpackage_agent-windows.yml uses. Against 99-37702 the winagent kept getting the Schannel curl built on 2026-05-19, so the flag was inert everywhere except a local EXTERNAL_SRC_ONLY=…
Now that the Windows agent's curl is OpenSSL-backed it has no CA bundle at all - configure reports "ca cert bundle: no" - so every HTTPS request would fail verification. Schannel used to read the machine's ROOT and CA stores on its own; CURLSSLOPT_NATIVE_CA asks OpenSSL for the same ones through the Win32 crypto API. Applied where the agent speaks HTTPS on Windows: the https_client transport, and…
Now that the Windows agent's curl is OpenSSL-backed it has no CA bundle at all - configure reports "ca cert bundle: no" - so every HTTPS request would fail verification. Schannel used to read the machine's ROOT and CA stores on its own; CURLSSLOPT_NATIVE_CA asks OpenSSL for the same ones through the Win32 crypto API. Applied where the agent speaks HTTPS on Windows: the https_client transport, and…
Now that the Windows agent's curl is OpenSSL-backed it has no CA bundle at all - configure reports "ca cert bundle: no" - so every HTTPS request would fail verification. Schannel used to read the machine's ROOT and CA stores on its own; CURLSSLOPT_NATIVE_CA asks OpenSSL for the same ones through the Win32 crypto API. Applied where the agent speaks HTTPS on Windows: the https_client transport, and…
The RTR job for client-agent/https_client stops at its AStyle stage, so cppcheck is the only check that ever runs on the module. Two files disagree with ci/input/astyle.config: a continuation line in httpsClientFacade.cpp and, in statelessStream_test.cpp, another continuation plus a braced initializer whose brace has to sit on its own line under Allman. Output of build.py --sformat, so it is white…
Merge pull request #38271 from wazuh/fix/38265-remove-stale-ec2-timin…
Manager Removed Removed deprecated wazuh-dbd daemon and database_output configuration. (#37035) Fixed Improved cluster payload buffer allocation strategy. (#37280) Improved cluster archive decompression limits. (#37119) Improved cluster worker file path validation. (#36998) Improved API authentication stability with bounded thread pools, regex timeouts and payload size limits. (#37034) Updated aio…
Manager Changed Masked authd.pass in configuration API responses for users without update permissions. (#34128) Fixed Fixed analysisd plugin decoder argument alignment. (#35222) Fixed path traversal in authd via agent group name validation. (#35258) Hardened cluster deserialization by restricting callable decoding to Wazuh modules and improving error handling. (#35256) Fixed DAPI callable resoluti…
Merge pull request #38059 from wazuh/fix/37526-error-1720-installing-…
What's Changed fix: persist engine startup state for CMSync route logging by @jam300 in #37356 Fix invalid MTU value reported for Windows network interfaces by @vikman90 in #37394 Restore modern.bpf.o checkfiles baseline reverted by 4.14.7 merge by @lchico in #37414 Suppress version-coordination WARNINGs on stop/unavailable module by @lchico in #37372 Clarify security policy for pre-release versio…
Manager Removed Removed deprecated wazuh-dbd daemon and database_output configuration. (#37035) Fixed Improved cluster payload buffer allocation strategy. (#37280) Improved cluster archive decompression limits. (#37119) Improved cluster worker file path validation. (#36998) Improved API authentication stability with bounded thread pools, regex timeouts and payload size limits. (#37034) Updated aio…
Compilation error in HP-UX arch
Manager Removed Removed unused SSL/TLS transport option from cluster. (#35648) Fixed Improved message decompression handling in remoted. (#35773) Improved agent name validation to reject names starting with dot. (#35833) Fixed segfault in vulnerability scanner module shutdown when disabled. (#36011) Fixed string buffer handling in version comparison function. (#36059) Improved cluster file synchro…