4.14.9 Release notes - 14 October 2026

#38571 Added the missing compiler hardening flags (stack canary, PIE, full RELRO and FORTIFY_SOURCE) to the Linux binaries.

#39471 The API access log no longer writes the run_as authorization context verbatim unless debug logging is enabled; hash_auth_context still identifies it.

#39746 Narrowed the Windows agent MSI pending-restart check to the agent's own files.

#39577 Added a script that builds the eBPF precompiled dependency with Zig for every Linux architecture.

#38509 Raised from 64 to 1024 the number of active response commands that wazuh-execd can load from etc/shared/ar.conf.

#38571 Added the missing compiler hardening flags (stack canary, PIE, full RELRO and FORTIFY_SOURCE) to the Linux binaries.

#39167 Removed the per-comparison JSON serialisation from the macOS ports deduplication in syscollector.

#39591 Allowed FIM eBPF whodata on capable kernels older than 5.8, such as RHEL 8.10.

#39148 Updated embedded Python to 3.10.21 and dependencies cryptography, pip, pyasn1 and setuptools.

#39148 Updated the Google Cloud dependencies (google-cloud-storage, google-cloud-core, google-auth and google-resumable-media), which relied on the pkg_resources module removed in setuptools 82.

#8978 Upgraded jsdom and its dependencies (lodash to 4.18.1, form-data to 3.0.5).

#39051 Fixed the vulnerability scanner stalling while the CTI feed applies a backlog of offsets, by releasing the feed lock between offset files instead of holding it for the whole backlog.

#38427 Bounded the agent control message copy to the source string length in wazuh-remoted.

#38449 Fixed the cluster server keeping pre-authentication connections open indefinitely by adding a handshake deadline and a global connection limit.

#39539 Fixed wazuh-authd keeping idle enrolment connections open indefinitely by closing any connection that has not completed its request within 30 seconds.

#38548 Fixed a memory leak in the wazuh-analysisd JSON decoder when an event repeats a static field.

#38625 Fixed integer underflows and an overflow in the OS_StrBreak() string splitter.

#38594 Restricted the Azure Graph wodle pagination to the Microsoft Graph endpoint, so the authentication token is not sent to another host.

#38474 Fixed false positive vulnerability reports for Debian packages installed from backports suites.

#38686 Added Fluentd server identity verification to the fluent-forward module: the certificate name is now checked against the configured address and the shared key digest returned by the server is verified.

#38804 Aligned the API force parameter with its OpenAPI schema: POST /agents now declares it, and POST /agents/insert no longer sends a force object that the request did not carry.

#38894 Escaped control characters in the request path of the API plain-text access log, so an unauthenticated request can no longer forge access log entries.

#39041 Fixed the indexer connector silently diverging from the wazuh-states-* indices: per-item _bulk rejections are now logged instead of ignored, aggregated by error type and reason, _delete_by_query responses reporting failures or version conflicts are now logged too, agent-ID deletions no longer match by raw string prefix, and a DELETED document no longer sweeps in sibling documents whose ID merely starts with the deleted one.

#39471 Raised the default API run_as authentication-context payload size limit from 8 KB to 64 KB and made it configurable via the new auth_context_max_payload_size option, for AD/LDAP/SSO logins with large group-membership contexts.

#38767 Fixed false error log when macOS log stream process exits during graceful agent shutdown.

#38301 Fixed missing Windows FIM inventory for file names with non-ANSI characters.

#39201 Fixed an agent crash caused by unsynchronized reads of the FIM directories list from the whodata callbacks.

#39360 Fixed FIM eBPF whodata dropping events on hosts whose NSS backend is remote.

#38277 Fixed the Windows agent MSI upgrade leaving the agent broken after the next reboot, and the silent /q upgrade hanging, when a system restart was pending.

#38340 Fixed syscollector sometimes keeping excluded macOS packages in the inventory.

#38410 Fixed wazuh-execd crashing when more active response commands than supported are defined.

#38431 Fixed WPK upgrade failing on agents without the find binary.

#38472 Bounded the snort-full log record appends to the available buffer space and sized the queued preprocessor message from its own line in wazuh-logcollector.

#38545 Fixed FIM whodata falling back to audit on arm64 kernels where the BPF-LSM hooks cannot load or attach, by retrying with the kprobe program set.

#38688 Restricted the GitHub, Office 365 and MS Graph wodles pagination and content retrieval to the configured API host, so the authentication token is not sent to another host.

#38382 Fixed whodata (audit) holding the audisp socket undrained at startup when the manager is unreachable, starving other audit plugins.

#38637 Fixed the disable-account active response reporting success when the account was not disabled, and stopped is_valid_username() from rejecting valid usernames containing consecutive dots.

#38645 Fixed the disable-account active response returning success when the account command was missing or the system was not supported.

#38856 Fixed the gcloud wodle masking missing-dependency errors as an unrelated AttributeError.

#38651 Restricted active response usernames to an allowlist, rejecting quotes, shell metacharacters, control characters and non-ASCII bytes.

#38969 Fixed process names truncated to fifteen characters in the syscollector inventory.

#38868 Fixed the gcloud wodle's Pub/Sub integration failing to start whenever the bucket integration's dependencies (e.g. google-cloud-storage) were broken, by deferring each integration's imports so a failure in one no longer blocks the other.

#39119 Fixed the macOS agent's default FIM configuration monitoring /etc, which macOS resolves as a symlink to /private/etc; without follow_symbolic_link enabled, syscheck only recorded the symlink itself, leaving every file under it (sudoers, sshd_config, pam.d, hosts) uncovered. The default <directories>, <ignore>, and <nodiff> entries now target /private/etc directly.

#39126 Fixed the macOS agent's syscollector process and port inventory being truncated, because proc_listallpids() was called with the buffer size expressed in pid_t count instead of bytes.

#39124 Fixed the default agent nodiff list not protecting /etc/shadow and real key paths.

#38627 Fixed FIM not monitoring user-mounted tmpfs directories mistaken for /dev.

#38943 Fixed the gcloud wodle silently discarding a crashed process's raw output when it produced no recognized log line, and fixed wm_exec() (shared by every wodle) reporting exit code 0 for a process killed by a signal, such as an OOM kill or a native segfault, which had made that raw-output fallback unreachable for exactly the crashes it was meant to catch.

#39198 Fixed the default Windows FIM configuration monitoring none of its 19 named critical binaries (cmd.exe, lsass.exe, sc.exe, sethc.exe, etc.), because duplicate %WINDIR%\SysNative / %WINDIR%\System32 directory declarations collapsed onto the same path once normalized and silently replaced each other's restrict list.

#39160 Fixed the macOS postinstall not re-owning ossec-era files, due to an unterminated find -exec.

#30480 Fixed the AWS wodle rejecting the us-gov-east-1 and us-gov-west-1 regions as invalid.

#39356 Fixed the macOS agent not reporting the password status and hash algorithm of local users.

#39356 Fixed the macOS agent reporting zeroed password aging values for local users, where macOS defines no such policy.

#39165 Fixed the users inventory misreporting sudoers, missing group-based grants (e.g. macOS's %admin, Linux's %sudo/%wheel) and flagging unrelated accounts.

#39165 Fixed the users inventory never reading sudo grants placed in sudoers drop-in files (/etc/sudoers.d/*).

#39353 Fixed the Windows agent accepting <whodata><provider>ebpf</provider></whodata> and silently disabling whodata.

#39570 Fixed the FIM eBPF whodata healthcheck failing on RHEL 9 kernels and discarding the eBPF provider.

#39708 Fixed FIM eBPF whodata dropping events for files outside the root mount.

#40084 Fixed the Windows netsh and route-null active responses failing with Cannot read 'srcip' from data since v4.14.7, because the IP validation called getaddrinfo() without initializing Winsock.

#38669 Fixed multiple checks with deprecated commands in Apple macOS 26.0 SCA file.

#39047 Fixed false-pass on the CIS Amazon Linux 2023 and Ubuntu 18.04 minimum password-days checks.

#39166 Fixed a Permisive typo failing the SELinux mode check on compliant hosts across 5 SCA policies.

#39474 Fixed the CIS Ubuntu 20.04 and Debian 10 "nologin is not listed in /etc/shells" check always reporting passed, by matching nologin instead of the never-occurring nologins.

#38679 Fixed SCA checks silently failing across macOS, RHEL/Debian, AlmaLinux, Amazon Linux, CentOS, Oracle Linux, and Rocky Linux, Ubuntu, Solaris, MongoDB policies by adding missing shell wrappers and fixing broken rule syntax.

#9141 Fixed override of Server API authorization header.

#9313 Fixed the enabled status shown for active response commands, the GitHub module and the Command wodle.

wazuh/wazuh

wazuh/wazuh-dashboard-plugins

wazuh/wazuh-ansible

wazuh/wazuh-kubernetes

wazuh/wazuh-puppet

wazuh/wazuh-docker

wazuh/qa-integration-framework

wazuh/wazuh-documentation