Wazuh 5.0 beta1 was released in April 2026. The two changes that affect existing deployments the most: the agent communication protocol has been rewritten (agents on 4.x will need upgrading before they reconnect), and the bundled OpenSearch-based indexer is replaced with Wazuh's own indexer component.
The new indexer is meant to reduce the operational overhead of managing OpenSearch tuning separately from Wazuh. Whether it actually does depends on how heavily you've customized your index templates. If you've added custom mappings, test the migration on a non-production copy first.
For homelab users running Wazuh manager on a single VM: the upgrade script handles the indexer replacement, but it requires about 10 minutes of downtime during the data migration step. Plan accordingly if your SIEM feeds any alerting that expects continuous data.
The full release notes and upgrade guide are at wazuh.com/blog. The agent compatibility matrix is in the upgrade documentation.
Worth watching: how the new indexer performs under high event volume. The OpenSearch version it replaces had known memory pressure issues above roughly 50,000 events per second on small instances. Wazuh's release notes claim improvements there but don't give specific numbers.