4.10.5 Release notes - 15 September 2026

This section lists the changes in version 4.10.5. Every update of the Wazuh solution is cumulative and includes all enhancements and fixes from previous releases.

What's new

This release includes new features or enhancements as the following:

Wazuh dashboard

#8576 Removed the unnecessary axios plugin dependency, provided by the OpenSearch Dashboards platform.
#8582 Removed the unnecessary follow-redirects plugin dependency and upgraded the dompurify and swagger-client dependencies.
#8978 Upgraded jsdom and its dependencies (lodash to 4.18.1, form-data to 3.0.5).

Resolved issues

This release resolves known issues as the following:

Wazuh manager

#36243 Hardened RSA decryption to reject malformed ciphertext blobs.
#38375 Improved cluster merged file parameter validation to prevent directory escape.
#38376 Improved tmp_file path validation in cluster DAPI.
#38377 Improved cluster non-merged file path validation during worker file processing.
#38378 Improved cluster worker file path validation.
#38379 Improved destination path validation when uploading CDB list, rule, and decoder files.
#38380 Improved cluster master validation of the files received from worker nodes.
#38381 Fixed a remote-command configuration validation bypass where upper- or mixed-case XML element names let localfile and wodle command blocks pass the remote_commands restriction.

Changelogs

The repository changelogs provide more details about the changes.