Unsafe callable deserialization and RBAC context injection in Wazuh Cluster DAPI (CVE-2026-28220)

Two vulnerabilities in Wazuh's Cluster Distributed API (DAPI) allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to cause the master node to deserialize an attacker-controlled callable and execute it under an attacker-controlled RBAC context. The first issue stems from an overly broad callable allowlist that permits resolution of any internal function whose top-level package is `wazuh` or `api`; the second allows an attacker to supply a client-controlled `rbac_permissions` value that bypasses authorization checks for `@expose_resources`-protected functions when `rbac_mode` is set to `black`. These two weaknesses can be combined to perform privileged administrative actions on the master node, including arbitrary file writes under `WAZUH_PATH`, creation of new API users, and tampering with `security.yaml`, and can be chained into full manager compromise. Affected versions: - >= 4.0.0 We recommend updating to: 4.14.5. CVSS 8.4 · our assessment: this_week Reference: https://github.com/wazuh/wazuh/security/advisories/GHSA-w2jj-pfq9-mh9p Details: https://vuln.today/cve/CVE-2026-28220