Executive brief
Wazuh is a security platform that monitors systems and detects threats across enterprise networks. A critical vulnerability in cluster synchronization allows an authenticated peer with access to the shared encryption key to write arbitrary files to the system, including overwriting the main configuration file. An attacker can modify the configuration to execute commands as root when Wazuh services restart, leading to complete system compromise.
Technical details
The vulnerability is a path traversal flaw in the cluster.unmerge_info() function (framework/wazuh/core/cluster/cluster.py) and process_files_from_worker() (framework/wazuh/core/cluster/master.py). These functions construct file paths from merge_type and name values provided by cluster peers in synchronized archives without proper validation. An attacker with the shared Fernet encryption key can craft malicious merge-file headers or files_metadata.json entries containing directory traversal sequences (e.g., ../../../) to write files outside the intended cluster directory. This allows writing to arbitrary locations such as /var/ossec/etc/ossec.conf, which is executed with root privileges when Wazuh reloads, enabling remote code execution. The fix validates merge file parameters to constrain paths to the declared cluster item directory.
Affected products
- Wazuh Wazuh 4.0.0 until 4.14.6, 5.0.0-beta3
Timeline
- 2026-08-19: disclosed
- 2026-05-20: patched: Fixed in versions 4.14.6 and 5.0.0-beta3