Executive brief
Wazuh is an open-source security platform used to detect and respond to threats across enterprise infrastructure. A vulnerability in how Wazuh's distributed cluster merges API responses allows a compromised worker node to execute arbitrary code on the master server with root privileges. An attacker controlling a worker node can inject malicious Python code that runs on the central management server when it processes results from multiple nodes.
Technical details
The vulnerability exists in AffectedItemsWazuhResult.merge() within framework/wazuh/core/results.py, which unsafely resolves attacker-controlled type names from the sort_casting field in cluster worker JSON responses through Python builtins without an allowlist. An attacker with control of a worker node can set sort_casting to "exec" and place Python source code in the affected_items field; when the master merges responses from multiple nodes, the payload executes with root privileges. The fix adds type validation to restrict sort_casting to an allowlist of safe types ('int', 'float', 'str', 'bool') and enforces structural validation (must be a list of strings). Affected versions are 4.0.0 through 4.14.5 and 5.0.0-beta1, with patches released in 4.14.6 and 5.0.0-beta2.
Affected products
- Wazuh Wazuh 4.0.0 to 4.14.5, 5.0.0-beta1
Timeline
- 2026-08-19: disclosed
- 2026-04-28: patched: Fix committed; versions 4.14.6 and 5.0.0-beta2 include patch