Wazuh v4.14.7 release notes

Wazuh v4.14.7

v4.14.7Jul 30, 2026 · 7 days ago

Wazuh v4.14.7

Added 2

Add IP address validation to the ip-customblock active response to prevent malformed input in file path operations
Add a null check for inode and device fields in the FIM whodata event handler

Changed 1

Update aiohttp, cryptography, PyJWT, python-multipart and starlette Python dependencies

Fixed 15

Improve cluster payload buffer allocation strategy
Improve cluster archive decompression limits
Improve cluster worker file path validation
Improve API authentication stability with bounded thread pools, regex timeouts and payload size limits
Fix AWS SQS subscriber wodle resolving the wrong AWS account for cross-account iam_role_arn configurations
Fix agent keepalive scheduling after a system clock rollback causing false Disconnected status
Fix eBPF FIM whodata dropping file events on older kernels such as Amazon Linux 2 and 2023
Fix eBPF FIM whodata missing file move/rename events into monitored folders
Fix multiple Debian, Ubuntu and Windows SCA checks generating incorrect results
Fix a typo in the SELinux SCA check causing false failures on CentOS 8, 9 and 10 systems configured as permissive
Fix the AlmaLinux 9 and 10 bootloader permissions SCA check regex and optional file handling
Fix the /etc/gshadow- permissions SCA check always failing due to an incorrect all condition
Fix a macOS SCA PolicyBanner check false failure by wrapping the command in sh -c for glob expansion
Fix TypeError when sorting agents by version with empty version strings
Improve sensitive data masking in cluster configuration endpoint

Removed 1

Improved cluster payload buffer allocation strategy. (#37280)
Improved cluster archive decompression limits. (#37119)
Improved cluster worker file path validation. (#36998)
Improved API authentication stability with bounded thread pools, regex timeouts and payload size limits. (#37034)
Updated aiohttp, cryptography, PyJWT, python-multipart and starlette Python dependencies. (#37361)

Fixed AWS SQS subscriber wodle resolving the wrong AWS account for cross-account iam_role_arn configurations. (#36791)
Fixed agent keepalive scheduling after a system clock rollback causing false Disconnected status. (#36338)
Fixed eBPF FIM whodata dropping file events on older kernels such as Amazon Linux 2 and 2023. (#37014)
Fixed eBPF FIM whodata missing file move/rename events into monitored folders. (#37023)
Added IP address validation to the ip-customblock active response to prevent malformed input in file path operations. (#36730)
Added a null check for inode and device fields in the FIM whodata event handler. (#37245)

Fixed multiple Debian, Ubuntu and Windows SCA checks generating incorrect results. (#37385)
Fixed a typo in the SELinux SCA check causing false failures on CentOS 8, 9 and 10 systems configured as permissive. (#36361)
Fixed the AlmaLinux 9 and 10 bootloader permissions SCA check regex and optional file handling. (#36396)
Fixed the /etc/gshadow- permissions SCA check always failing due to an incorrect all condition. (#36795)
Fixed a macOS SCA PolicyBanner check false failure by wrapping the command in sh -c for glob expansion. (#36783)

Fixed TypeError when sorting agents by version with empty version strings. (#37323)
Improved sensitive data masking in cluster configuration endpoint. (#37039)