4.10.4 Release notes - 21 May 2026

#34128 Masked authd.pass in configuration API responses for users without update permissions.

#34661 Added detection of the -a never,task Audit rule in FIM whodata for Linux.

#34680 Changed sync primitive disposal to stop and soften teardown failures.

#34687 Updated curl dependency to version 8.12.1.

#33383 Updated starlette dependency to version 0.49.1.

#32790 Upgraded the embedded Python interpreter to version 3.10.19.

#8135 Added an API selector warning when run_as is set to false in the wazuh.yml file.

#8135 Set run_as to true by default in the wazuh.yml file.

#35222 Fixed analysisd plugin decoder argument alignment.

#35258 Fixed path traversal in authd through agent group name validation.

#35256 Hardened cluster deserialization by restricting callable decoding to Wazuh modules and improving error handling.

#35256 Fixed DAPI callable resolution to restrict invocations to exposed resources only.

#35469 Fixed admin protection in the update user endpoint.

#34690 Fixed protected settings checks when multiple <ossec_config> blocks are present.

#34659 Restricted cluster file transfer write paths.

#35008 Improved cluster file synchronization path handling by adding safe path joins.

#31901 Fixed Vulnerability Detector offset database updates to occur only after processing (backport from 4.12.0).

#34679 Fixed Windows FIM Registry scan crash on non-null-terminated values.

wazuh/wazuh

wazuh/wazuh-dashboard-plugins

wazuh/wazuh-ansible

wazuh/wazuh-kubernetes

wazuh/wazuh-puppet

wazuh/wazuh-docker

wazuh/qa-integration-framework

wazuh/wazuh-documentation