# Wazuh v5.0.0-beta5 — Wazuh v5.0.0 Beta 5

- Product: Wazuh (https://whatsnew.fyi/product/wazuh)
- Vendor: Wazuh
- Date: 2026-09-01
- Version: v5.0.0-beta5
- Original notes: https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta5
- Permalink: https://whatsnew.fyi/product/wazuh/releases/v5.0.0-beta5
- Labels: Pre-release

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **changed** — Lower log level of transient cluster failures
- **fixed** — Fix github actions shell
- **changed** — SCA Policy Adjustments
- **removed** — Remove unused assignment for bpf object
- **fixed** — Preserve original scan_day/scan_time strings in syscheck config
- **changed** — Multi SCA, Decoder and Rule fixes
- **changed** — Improve API authentication stability and resource limits
- **fixed** — Compilation error in HP-UX arch
- **fixed** — Maintain crypto_method on keystore rebuild
- **security** — Fix RBAC permission bypass in GET /security/actions and /security/resources
- **fixed** — Validate destination paths when uploading list, rule, and decoder files
- **fixed** — Prevent cluster worker from overwriting protected master files
- **changed** — Improve access control on the agent active-configuration endpoint
- **fixed** — Prevent race condition in Windows RSA key container initialization
- **fixed** — Limit node expansion in yaml2json
- **fixed** — Correct EnableMulticast expected value in Windows LLMNR checks
- **fixed** — Prevent spurious CRITICAL (1211) queue error during rootcheck/FIM shutdown on WPK upgrade
- **changed** — Add sshd-session/sshd-auth to default macOS ULS query
- **fixed** — Fix analysisd deadlock on AR send when the queue is not drained
- **added** — Expose audit_uid, audit_gid and effective_uid in eBPF whodata provider

##### What's Changed
* fix(ci): correct S3 artifact run directory layout for 4.14.7 by @jr0me in https://github.com/wazuh/wazuh/pull/37377
* Lower log level of transient cluster  failures by @ignaciogalle12git in https://github.com/wazuh/wazuh/pull/37338
* Fix github actions shell by @Miguevrgo in https://github.com/wazuh/wazuh/pull/37355
* SCA Policy Adjustments by @Johnng007 in https://github.com/wazuh/wazuh/pull/37385
* Bump 4.14.8 branch by @wazuhci in https://github.com/wazuh/wazuh/pull/37404
* fix(ci): grant OIDC to Coverity S3 jobs by @jr0me in https://github.com/wazuh/wazuh/pull/37406
* Remove unnused assignment for bpf object by @Miguevrgo in https://github.com/wazuh/wazuh/pull/37424
* Fix changelog workflow by @TomasTurina in https://github.com/wazuh/wazuh/pull/37431
* Preserve original scan_day/scan_time strings in syscheck config by @lchico in https://github.com/wazuh/wazuh/pull/37412
* Multi SCA, Decoder and Rule fixes by @Johnng007 in https://github.com/wazuh/wazuh/pull/37434
* Improve API authentication stability and resource limits by @jepalfer in https://github.com/wazuh/wazuh/pull/37034
* Bump 4.14.7 branch by @wazuhci in https://github.com/wazuh/wazuh/pull/37523
* Update CHANGELOG for v4.14.7 by @vikman90 in https://github.com/wazuh/wazuh/pull/37536
* Adjusted file sizes in the check files by @MarcelKemp in https://github.com/wazuh/wazuh/pull/37544
* Compilation error in HP-UX arch by @fcontrerasc in https://github.com/wazuh/wazuh/pull/37545
* Maintain crypto_method on keystore rebuild by @jpcerrone in https://github.com/wazuh/wazuh/pull/37524
* Merge 4.14.7 into 4.14.8 by @vikman90 in https://github.com/wazuh/wazuh/pull/37679
* Fix RBAC permission bypass in GET /security/actions and /security/resources by @vikman90 in https://github.com/wazuh/wazuh/pull/37678
* Validate destination paths when uploading list, rule, and decoder files by @vikman90 in https://github.com/wazuh/wazuh/pull/37691
* Prevent cluster worker from overwriting protected master files by @vikman90 in https://github.com/wazuh/wazuh/pull/37694
* Improve access control on the agent active-configuration endpoint by @vikman90 in https://github.com/wazuh/wazuh/pull/37716
* Fix typo in SCA rules by @Miguevrgo in https://github.com/wazuh/wazuh/pull/37652
* Prevent race condition in Windows RSA key container initialization (randombytes) by @MarcelKemp in https://github.com/wazuh/wazuh/pull/37701
* Limit node expansion in yaml2json by @vikman90 in https://github.com/wazuh/wazuh/pull/37725
* Reorder revoke-token from API integration test by @Antoniogm03 in https://github.com/wazuh/wazuh/pull/37696
* Fix benchmark test_cluster_error_logs test by @jepalfer in https://github.com/wazuh/wazuh/pull/37425
* Correct EnableMulticast expected value in Windows LLMNR checks by @Darioortegaleyva in https://github.com/wazuh/wazuh/pull/37765
* Prevent spurious CRITICAL (1211) queue error during rootcheck/FIM shutdown on WPK upgrade by @Darioortegaleyva in https://github.com/wazuh/wazuh/pull/37715
* Add sshd-session/sshd-auth to default macOS ULS query by @Darioortegaleyva in https://github.com/wazuh/wazuh/pull/37769
* Remove multiple warning messages for each unathorized shared policy by @Miguevrgo in https://github.com/wazuh/wazuh/pull/37741
* Fix typo in SCA rules by @Miguevrgo in https://github.com/wazuh/wazuh/pull/37770
* Restore legacy 5.0 deprecation notes and update wm_control migration by @cborla in https://github.com/wazuh/wazuh/pull/37829
* Fix analysisd deadlock on AR send when the queue is not drained by @ignaciogalle12git in https://github.com/wazuh/wazuh/pull/37764
* Disable OpenSSL runtime CPU probing in Python daemon wrappers by @jotacarma90 in https://github.com/wazuh/wazuh/pull/37773
* Disable OpenSSL runtime CPU probing in Python daemon wrappers by @jotacarma90 in https://github.com/wazuh/wazuh/pull/37839
* Expose audit_uid, audit_gid and effective_uid in eBPF whodata provider by @Darioortegaleyva in https://github.com/wazuh/wazuh/pull/37060
* Fi

_[Truncated at 4000 characters — full notes: https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta5]_