# CVE-2026-61800: Wazuh arbitrary file write in cluster worker file sync

Source: https://junglewise.ai/threats/cve-2026-61800-wazuh-arbitrary-file-write-in-cluster-worker-file-sync  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61800 · Severity: critical · CVSS 9.1 · Published 2026-08-28

Wazuh is an open-source security monitoring platform used to protect endpoints and cloud infrastructure. A compromised cluster master or anyone with the cluster key can write or delete arbitrary files under /var/ossec on all worker nodes, including files executed as root, resulting in remote code execution across the entire worker fleet.

Technologies: [Wazuh](https://junglewise.ai/threats/technologies/wazuh). Vendors: [Wazuh](https://junglewise.ai/threats/vendors/wazuh).

## Quick answers

**Is CVE-2026-61800 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61800 being exploited in the wild.

**How severe is CVE-2026-61800?** Critical severity, with a CVSS score of 9.1, published 28 August 2026.

**Which products and versions are affected?** Wazuh 4.4.0 through 4.14.6.

**Is there a fix for CVE-2026-61800?** A patch was published on 2026-06-24: Fix committed to repository (f7f7c4d) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61800 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-61800?** Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a path traversal vulnerability in the cluster worker file synchronization code (framework/wazuh/core/cluster/worker.py, update_master_files_in_worker function). The non-merged and extra file branches lack a destination-directory confinement check that exists on the master side and in the worker's merged branch. While safe_join() prevents escape outside /var/ossec, it does not validate that files land in their declared cluster_item_key directory, allowing an attacker to place files anywhere under /var/ossec including executable locations like active-response/bin, wodles, and integrations. The vulnerability affects versions 4.4.0 through 4.14.6 and is an incomplete fix for CVE-2026-30893. The cluster key is a shared secret distributed to all nodes, so any holder can exploit this. Fixed in version 4.14.7.

## Affected products

- Wazuh Wazuh 4.4.0 through 4.14.6

## Timeline

- 2026-08-28: disclosed: CVE-2026-61800 published on NVD
- 2026-06-24: patched: Fix committed to repository (f7f7c4d)
- 2026-06-18: other: Fix authored
- 2026-08-18: other: GitHub Security Advisory GHSA-3jff-488g-335f published

## References

- [https://github.com/wazuh/wazuh/commit/f7f7c4d2d9e683c5d42e997fe7028a3fb2578853](https://github.com/wazuh/wazuh/commit/f7f7c4d2d9e683c5d42e997fe7028a3fb2578853)
- [https://github.com/wazuh/wazuh/security/advisories/GHSA-3jff-488g-335f](https://github.com/wazuh/wazuh/security/advisories/GHSA-3jff-488g-335f)

## Related threats

- [Wazuh heap buffer overflow in Windows EventChannel decoder](https://junglewise.ai/threats/cve-2026-62365-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh unauthenticated memory exhaustion in cluster listener](https://junglewise.ai/threats/cve-2026-71540-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh stack exhaustion in XML parser via element attributes](https://junglewise.ai/threats/cve-2026-61811-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh cluster key disclosure in GET /cluster/local/config](https://junglewise.ai/threats/cve-2026-61802-wazuh-cluster-key-disclosure-in-get-cluster-local-config)
- [Wazuh authentication bypass in config masking via RBAC](https://junglewise.ai/threats/cve-2026-61783-wazuh-authentication-bypass-in-config-masking-via-rbac)