# CVE-2026-74044: Wazuh path traversal in cluster node name validation

Source: https://junglewise.ai/threats/cve-2026-74044-wazuh-path-traversal-in-cluster-node-name-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-74044 · Severity: medium · CVSS 6.5 · Published 2026-08-18

Wazuh is an open-source security monitoring and incident response platform used by organizations to protect their infrastructure. A path traversal vulnerability in Wazuh's cluster communication allows an attacker with a valid cluster key to delete arbitrary files and directories from the Wazuh installation by crafting a malicious node name. An attacker can trigger this by sending a single malformed message and disconnecting, causing automatic cleanup routines to destroy configuration files, rules, or other critical data without operator warning.

Technologies: [Wazuh](https://junglewise.ai/threats/technologies/wazuh), [Wazuh Manager](https://junglewise.ai/threats/technologies/wazuh-manager). Vendors: [Wazuh](https://junglewise.ai/threats/vendors/wazuh).

## Quick answers

**Is CVE-2026-74044 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-74044 being exploited in the wild.

**How severe is CVE-2026-74044?** Medium severity, with a CVSS score of 6.5, published 18 August 2026.

**Which products and versions are affected?** Wazuh Manager 4.0.0 through 4.14.5.

**Is there a fix for CVE-2026-74044?** A patch was published on 2026-05-27: Fix merged in pull request #36460, released in version 4.14.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-74044 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-74044?** Check whether you run Wazuh or Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw in Wazuh's cluster peer communication. The AbstractServerHandler.hello() method in framework/wazuh/core/cluster/server.py accepts a node name from a cluster peer without validation—no regex, length limit, or character set restriction. When a peer disconnects, the cluster.clean_up() function uses this peer-supplied node name in a path.join() call that does not canonicalize or constrain paths; an attacker can inject traversal sequences like "../../etc/rules" to escape the intended queue/cluster/ directory. The cleanup routine then recursively deletes the contents of the traversal-resolved directory (except c-internal.sock). Attack preconditions: network access to the cluster port (default TCP/1516) and knowledge of the cluster Fernet key (which is static and shareable). No prior worker registration is required. The patch (4.14.6) validates the node name format to prevent traversal sequences.

## Affected products

- Wazuh Wazuh Manager 4.0.0 through 4.14.5

## Timeline

- 2026-08-18: disclosed
- 2026-05-27: patched: Fix merged in pull request #36460, released in version 4.14.6

## References

- [https://github.com/wazuh/wazuh/pull/36460](https://github.com/wazuh/wazuh/pull/36460)
- [https://github.com/wazuh/wazuh/security/advisories/GHSA-f34r-fcjf-qx6j](https://github.com/wazuh/wazuh/security/advisories/GHSA-f34r-fcjf-qx6j)

## Related threats

- [Wazuh Manager SQL injection in WazuhDBBackend._substitute_params](https://junglewise.ai/threats/cve-2026-112341-wazuh-versions-from-4-0-0-before-4-14-9-contain-a-sql-injection)
- [Wazuh missing TLS hostname verification in fluent-forward module](https://junglewise.ai/threats/cve-2026-112339-wazuh-from-3-9-0-before-4-14-9-contains-a-missing-tls-hostname)
- [Wazuh GitHub module server-side request forgery in pagination](https://junglewise.ai/threats/cve-2026-112338-wazuh-from-4-3-0-before-4-14-9-contains-a-server-side-request)
- [Wazuh Manager memory leak in JSON decoder](https://junglewise.ai/threats/cve-2026-112336-wazuh-manager-from-3-0-0-before-4-14-9-contains-a-memory-leak)
- [Wazuh heap buffer overflow in Windows EventChannel decoder](https://junglewise.ai/threats/cve-2026-62365-wazuh-is-an-open-source-security-platform-providing-unified-xdr)