Wazuh Manager NDJSON Injection via Unescaped Index Fields

Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin credentials, enabling document deletion, alert tampering, and cross-agent SIEM state manipulation.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-56699 represents a critical authentication bypass and data manipulation vulnerability in Wazuh Manager versions before 5.0.0-beta3. The vulnerability stems from improper input validation in the DataValue.index field, which fails to escape special characters when constructing OpenSearch bulk requests. This allows enrolled agents—typically considered trusted endpoints—to inject malicious NDJSON operations that execute under the manager's administrative credentials. Organizations running vulnerable Wazuh deployments face immediate risk of alert tampering, forensic evidence destruction, and cross-agent SIEM state poisoning, making this particularly dangerous for security operations teams relying on Wazuh for threat detection and incident response.

Casky's 322 matching skills leverage Claude's extended reasoning to detect exploitation patterns across TA0001 (Initial Access) and TA0043 (Reconnaissance) techniques by analyzing suspicious bulk request structures, unusual index field formatting, and anomalous OpenSearch operations originating from agent communication channels. Practitioners using Casky would identify attack indicators through skill-driven detection of injected delete/update operations, unexpected document modifications in security indices, and deviations from legitimate agent-to-manager request patterns. The platform's Claude-powered analysis correlates these technical indicators with behavioral anomalies—such as agents submitting malformed payloads or timing patterns inconsistent with normal operations—enabling security teams to distinguish exploitation attempts from benign agent communication and prioritize containment of compromised endpoints.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-56699.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-56699

Casky has 322 skills that investigate the attack patterns behind CVE-2026-56699. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn