Is CVE-2026-61783 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61783 being exploited in the wild.

How severe is CVE-2026-61783?

Medium severity, with a CVSS score of 6.5, published 28 August 2026.

Which products and versions are affected?

Wazuh Manager 4.14.0 through 4.14.6.

Is there a fix for CVE-2026-61783?

A patch was published on 2026-08-28: Fixed in version 4.14.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61783 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61783?

Check whether you run Wazuh or Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61783: Wazuh authentication bypass in config masking via RBAC

CVE-2026-61783 · Severity: medium · CVSS 6.5 · Published 2026-08-28

Wazuh is an open-source security platform used to protect endpoints and cloud workloads. A flaw in its role-based access control (RBAC) allows authenticated low-privilege users to read the cluster encryption key and other sensitive configuration values in clear text, defeating the normal masking that hides secrets. An attacker exploiting this could potentially join the cluster and impersonate legitimate nodes.

Technologies: Wazuh, Wazuh Manager. Vendors: Wazuh.

Quick answers

Is CVE-2026-61783 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61783 being exploited in the wild.
How severe is CVE-2026-61783?: Medium severity, with a CVSS score of 6.5, published 28 August 2026.
Which products and versions are affected?: Wazuh Manager 4.14.0 through 4.14.6.
Is there a fix for CVE-2026-61783?: A patch was published on 2026-08-28: Fixed in version 4.14.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61783 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61783?: Check whether you run Wazuh or Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a logic error in the RBAC permission check used by the mask_sensitive_config() decorator. The _has_update_permissions() function determines whether to apply masking by checking if an update-config rule exists, but fails to inspect the rule's effect field—treating both allow and deny rules as evidence of update capability. When a read-only user is hardened with an explicit deny rule on cluster:update_config or manager:update_config, the presence of that deny rule incorrectly triggers the permission gate, disabling masking. An authenticated GET request to /configuration?raw=true then returns the verbatim ossec.conf XML with cluster.key exposed in cleartext. The fix, released in version 4.14.7, adds an effect-value check to _has_update_permissions() so that only allow rules grant permission. Affected versions 4.14.0–4.14.6 require immediate patching.

Affected products

Wazuh Wazuh Manager 4.14.0 through 4.14.6

Timeline

2026-08-28: disclosed
2026-08-28: patched: Fixed in version 4.14.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.