Executive brief
Wazuh is an open-source security monitoring platform used to protect endpoints and cloud infrastructure. A compromised cluster master or anyone with the cluster key can write or delete arbitrary files under /var/ossec on all worker nodes, including files executed as root, resulting in remote code execution across the entire worker fleet.
Technical details
This is a path traversal vulnerability in the cluster worker file synchronization code (framework/wazuh/core/cluster/worker.py, update_master_files_in_worker function). The non-merged and extra file branches lack a destination-directory confinement check that exists on the master side and in the worker's merged branch. While safe_join() prevents escape outside /var/ossec, it does not validate that files land in their declared cluster_item_key directory, allowing an attacker to place files anywhere under /var/ossec including executable locations like active-response/bin, wodles, and integrations. The vulnerability affects versions 4.4.0 through 4.14.6 and is an incomplete fix for CVE-2026-30893. The cluster key is a shared secret distributed to all nodes, so any holder can exploit this. Fixed in version 4.14.7.
Affected products
- Wazuh Wazuh 4.4.0 through 4.14.6
Timeline
- 2026-08-28: disclosed: CVE-2026-61800 published on NVD
- 2026-06-24: patched: Fix committed to repository (f7f7c4d)
- 2026-06-18: other: Fix authored
- 2026-08-18: other: GitHub Security Advisory GHSA-3jff-488g-335f published