Executive brief
Wazuh is an open-source security platform used to protect endpoints and cloud workloads. A flaw in its role-based access control (RBAC) allows authenticated low-privilege users to read the cluster encryption key and other sensitive configuration values in clear text, defeating the normal masking that hides secrets. An attacker exploiting this could potentially join the cluster and impersonate legitimate nodes.
Technical details
The vulnerability is a logic error in the RBAC permission check used by the mask_sensitive_config() decorator. The _has_update_permissions() function determines whether to apply masking by checking if an update-config rule exists, but fails to inspect the rule's effect field—treating both allow and deny rules as evidence of update capability. When a read-only user is hardened with an explicit deny rule on cluster:update_config or manager:update_config, the presence of that deny rule incorrectly triggers the permission gate, disabling masking. An authenticated GET request to /configuration?raw=true then returns the verbatim ossec.conf XML with cluster.key exposed in cleartext. The fix, released in version 4.14.7, adds an effect-value check to _has_update_permissions() so that only allow rules grant permission. Affected versions 4.14.0–4.14.6 require immediate patching.
Affected products
- Wazuh Wazuh Manager 4.14.0 through 4.14.6
Timeline
- 2026-08-28: disclosed
- 2026-08-28: patched: Fixed in version 4.14.7