Wazuh

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you land upstream yourself and that stays merged, without reverts, for one month, not for the report. This project sits in Tier 2, where awards run from $100 to $5,000; the $15,000 headline is the Tier 1 column and is not reachable here. Patches must be between one and twelve months old, submissions are capped at three per person per month, memory-safety hardening can carry a 2× or 3× multiplier, and sanctions and territory exclusions apply. CVE history 35 Last 12 months 48 Lifetime Memory safety 35 % Injection 20 % Access control 20 % Denial of service 15 % Latest advisories Loading the feed Overview Wazuh is the most widely deployed open-source SIEM and XDR platform, the free alternative to Splunk and QRadar across small and mid-size enterprises, MSSPs and compliance-driven estates. Its agent runs privileged on Linux, Windows, macOS, Solaris and AIX endpoints, and the manager ingests attacker-influenced log data from every one of them. That shape is the whole reason to look: one decoder bug turns endpoint access into control of the monitoring plane. Thirty-five of Wazuh's forty-eight lifetime CVEs landed in the last twelve months, so the codebase is under active offensive research right now. Wazuh's SECURITY.md offers no reward and reports go to [email protected] , so sorona.xyz pays you directly on qualified, reproduced findings. In scope Wazuh takes security reports at [email protected] and its SECURITY.md attaches no reward and no narrower boundary. The covered object is the upstream wazuh/wazuh tree in full, manager and agent alike The manager's ingestion and analysis path end to end: wazuh-analysisd , the decoder set and the rule engine, all of which parse agent-forwarded log data an attacker on any monitored endpoint can shape The XML configuration and rule parser, the surface the project's own OSS-Fuzz fuzz_xml harness targets The agent-to-manager transport in full: wazuh-remoted , the protocol on the wire, key exchange and message authentication The agent as a whole, including the syscheck/FIM, rootcheck and syscollector modules and the active-response machinery, all running as root on Linux, Windows, macOS, Solaris and AIX endpoints wazuh-authd and the enrolment path, where a weak or bypassable enrolment lets an unauthorised agent into the estate The wazuh-db SQLite layer and every query the manager builds against attacker-influenced field values Out of scope The Wazuh Dashboard and Wazuh Indexer OpenSearch forks, which are separate repositories Wazuh Cloud, the hosted SaaS, as distinct from the code that runs in it Non-exploitable crashes whose fix is a one-liner, which Google explicitly declines to reward on the patch rail Patches over twelve months old, which Patch Rewards will not consider For the Google money specifically, anything reported but never patched upstream, since that pathway pays only on a merge Most-valued findings Memory corruption in wazuh-analysisd 's decoder or rule evaluation reached by a log line a compromised endpoint can emit, which is the class that turns endpoint access into control of the monitoring server and 35% of this project's history Command or SQL injection through decoder fields, active-response invocation or the wazuh-db layer, where attacker text crosses into a privileged execution or query context Authentication or enrolment bypass in wazuh-authd or wazuh-remoted that lets an unauthorised agent register or impersonate an existing one Privilege escalation on the endpoint through the root-running syscheck, rootcheck or syscollector modules, which multiplies across every monitored host Parsing defects in the XML configuration and rule loader, the surface already carrying a fuzzing harness and therefore the one with the clearest path to a patch Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report with the log line, rule, XML fragment or protocol capture that triggers the defect; if the maintainers can't reproduce it, it isn't eligible One vulnerability per report unless a chain is needed to show the real impact Only upstream wazuh/wazuh is covered. The Dashboard and Indexer forks and the hosted Wazuh Cloud are separate targets Give the maintainers room to ship a fix before any public writeup; Wazuh discloses on a fast release-note cadence, so the window is short but it is real If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for a month. The patch must be between one and twelve months old and you may submit at most three a month Google cannot pay researchers on sanctions lists, in sanctioned territories, or located in Russia or Belarus Disclosure Coordinated with Wazuh through [email protected] . The project publishes fixes with its releases at a high cadence and credits reporters in the release notes, so the practical embargo is the gap to the next release rather than a fixed clock; nothing in the Google rules restricts routing the finding through sorona.xyz. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability