Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Wazuh bug bounty programs

wazuh.com Updated

Wazuh runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
8
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Wazuh runs.

  • Wazuh

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

8 targets. 5 excluded.

  • https://wazuh.com

    Web

  • The agent as a whole, including the syscheck/FIM, rootcheck and syscollector modules and the active-response machinery, all running as root on Linux, Windows, macOS, Solaris and AIX endpoints

    Products and areas

  • The agent-to-manager transport in full: wazuh-remoted, the protocol on the wire, key exchange and message authentication

    Products and areas

  • The manager's ingestion and analysis path end to end: wazuh-analysisd, the decoder set and the rule engine, all of which parse agent-forwarded log data an attacker on any monitored endpoint can shape

    Products and areas

  • The wazuh-db SQLite layer and every query the manager builds against attacker-influenced field values

    Products and areas

  • The XML configuration and rule parser, the surface the project's own OSS-Fuzz fuzz_xml harness targets

    Products and areas

  • Wazuh takes security reports at [email protected] and its SECURITY.md attaches no reward and no narrower boundary. The covered object is the upstream wazuh/wazuh tree in full, manager and agent alike

    Products and areas

  • wazuh-authd and the enrolment path, where a weak or bypassable enrolment lets an unauthorised agent into the estate

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • For the Google money specifically, anything reported but never patched upstream, since that pathway pays only on a merge

  • Non-exploitable crashes whose fix is a one-liner, which Google explicitly declines to reward on the patch rail

  • Patches over twelve months old, which Patch Rewards will not consider

  • The Wazuh Dashboard and Wazuh Indexer OpenSearch forks, which are separate repositories

  • Wazuh Cloud, the hosted SaaS, as distinct from the code that runs in it

Recent changes

Reward and scope changes across every Wazuh program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Wazuh products, from the NVD.

Search NVD
  • CVE-2026-61800 Critical

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code execution as root. During cluster file synchronization, the non-merged branch of update_master_files_in_worker

  • CVE-2026-61802 Medium

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a masking control, mask_sensitive_config, that redacts sensitive fields such as authd.pass and cluster.key fr

  • CVE-2026-54085 High

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing argument injection into tools that run as root. Five of the eight scripts that handle the srcip field, r

  • CVE-2026-61783 High

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is disabled by any update-config RBAC rule, including an explicit deny. The mask_sensitive_config() decor

  • CVE-2026-54083 High

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script builds a file path by concatenating the srcip field taken from alert JSON directly onto the fixed /ipblock

  • CVE-2026-54084 Medium

    Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key response with fewer than four fields, causing a NULL pointer dereference. The w_enrollment_process_agent_key() routine split

  • CVE-2026-49392 Medium

    Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile() and DB::searchFile() in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems, FIMDBCreator::encodeString() does not escape the value. A local user who can create a filename in a File Integ

  • CVE-2026-49441 Critical

    Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusts a peer-controlled file_path key from files_metadata.json. The destination is joined to WAZUH_PATH without proving that it remains inside the directory selected by

About this page

This page gathers every public program listed under wazuh.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.