# CVE-2026-44901: Wazuh remote code execution in cluster merge

Source: https://junglewise.ai/threats/cve-2026-44901-wazuh-remote-code-execution-in-cluster-merge  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-44901 · Severity: high · CVSS 8.4 · Published 2026-08-19

Wazuh is an open-source security platform used to detect and respond to threats across enterprise infrastructure. A vulnerability in how Wazuh's distributed cluster merges API responses allows a compromised worker node to execute arbitrary code on the master server with root privileges. An attacker controlling a worker node can inject malicious Python code that runs on the central management server when it processes results from multiple nodes.

Technologies: [Wazuh](https://junglewise.ai/threats/technologies/wazuh). Vendors: [Wazuh](https://junglewise.ai/threats/vendors/wazuh).

## Quick answers

**Is CVE-2026-44901 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44901 being exploited in the wild.

**How severe is CVE-2026-44901?** High severity, with a CVSS score of 8.4, published 19 August 2026.

**Which products and versions are affected?** Wazuh 4.0.0 to 4.14.5, 5.0.0-beta1.

**Is there a fix for CVE-2026-44901?** A patch was published on 2026-04-28: Fix committed; versions 4.14.6 and 5.0.0-beta2 include patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44901 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-44901?** Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in AffectedItemsWazuhResult.merge() within framework/wazuh/core/results.py, which unsafely resolves attacker-controlled type names from the sort_casting field in cluster worker JSON responses through Python builtins without an allowlist. An attacker with control of a worker node can set sort_casting to "exec" and place Python source code in the affected_items field; when the master merges responses from multiple nodes, the payload executes with root privileges. The fix adds type validation to restrict sort_casting to an allowlist of safe types ('int', 'float', 'str', 'bool') and enforces structural validation (must be a list of strings). Affected versions are 4.0.0 through 4.14.5 and 5.0.0-beta1, with patches released in 4.14.6 and 5.0.0-beta2.

## Affected products

- Wazuh Wazuh 4.0.0 to 4.14.5, 5.0.0-beta1

## Timeline

- 2026-08-19: disclosed
- 2026-04-28: patched: Fix committed; versions 4.14.6 and 5.0.0-beta2 include patch

## References

- [https://github.com/wazuh/wazuh/commit/b29849f8abb08d78f257e6106b6111a8a1b0e621](https://github.com/wazuh/wazuh/commit/b29849f8abb08d78f257e6106b6111a8a1b0e621)
- [https://github.com/wazuh/wazuh/pull/35757](https://github.com/wazuh/wazuh/pull/35757)

## Related threats

- [Wazuh heap buffer overflow in Windows EventChannel decoder](https://junglewise.ai/threats/cve-2026-62365-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh unauthenticated memory exhaustion in cluster listener](https://junglewise.ai/threats/cve-2026-71540-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh stack exhaustion in XML parser via element attributes](https://junglewise.ai/threats/cve-2026-61811-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh cluster key disclosure in GET /cluster/local/config](https://junglewise.ai/threats/cve-2026-61802-wazuh-cluster-key-disclosure-in-get-cluster-local-config)
- [Wazuh arbitrary file write in cluster worker file sync](https://junglewise.ai/threats/cve-2026-61800-wazuh-arbitrary-file-write-in-cluster-worker-file-sync)