Skip to main content

Fix Metricbeat vulnerability

info

The instruction is only valid for v10.3.2.

On January 13, 2026, a vulnerability in Metricbeat (CVE-2026-0528) was discovered that involves improper validation of array indices. The vulnerability potentially affects environments where the Metricbeat module is enabled.

Until the update is available (scheduled in v10.3.3), you can mitigate the issue by disabling the affected functionality, which also disables the related dashboard. Detailed steps for applying the workaround are as follows:

  1. On all Master servers, comment out the following code lines in the /opt/workfusion/metricbeat/modules.d/zookeeper.yml file:

    - module: zookeeper
    metricsets:
    - mntr
    period: 10s
    hosts: ["127.0.0.1:2181"]
  2. Restart Metricbeat on all Master servers:

    wfmanager restart metricbeat