EUVD-2026-62557Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attacker must hold the shared cluster key so PR:H; the traversal breaks out of the cluster directory to root-owned config yielding scope change and full host compromise, so S:C and C/I/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmerge_info() in framework/wazuh/core/cluster/cluster.py constructs paths from peer-controlled merge_type and name values in a merged synchronization archive. process_files_from_worker() in framework/wazuh/core/cluster/master.py does not adequately confine the resulting path to the declared cluster item directory. A cluster peer holding the shared Fernet key can use traversal in files_metadata.json or a merged-file header to write files such as /var/ossec/etc/ossec.conf. Replacing ossec.conf can configure root-executed commands and lead to code execution when Wazuh services reload. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.
AnalysisAI
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in versions 4.0.0 through 4.14.5 and the 5.0.0-beta line up to 5.0.0-beta3. A malicious or compromised cluster peer that possesses the shared Fernet key can smuggle directory-traversal sequences through merge_type/name values or a merged-file header, causing the master node to write attacker-controlled files (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be a participating cluster peer that holds the shared cluster Fernet key used to authenticate/encrypt inter-node traffic - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are internally consistent for a high-severity but access-gated flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised a Wazuh worker node - or an insider with access to the shared Fernet key - crafts a merged synchronization archive whose files_metadata.json or merged-file header carries a traversal path (for example ../../etc/ossec.conf) and sends it to the master during normal sync. The master writes the attacker-controlled ossec.conf outside the intended cluster item directory, and on the next Wazuh service reload the injected root-executed command runs, giving code execution as root on the manager. … |
| Remediation | Upgrade to a fixed release: Vendor-released patch: Wazuh 4.14.6 for the 4.x line, or 5.0.0-beta3 for the 5.0 beta line (see GHSA-gh4h-fx78-q8xc, PR https://github.com/wazuh/wazuh/pull/36204, commit 88fc89fdfb1bf37b9d826e9c281a3d22655733de). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, complete an inventory of all Wazuh deployments, identify which installations run affected versions (4.0.0-4.14.5 for the 4.x line or 5.0.0-beta through beta3 for the 5.x line), and prioritize master nodes and cluster peers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that al
Wazuh Manager in Wazuh through 4.1.5 is affected by a remote Integer Underflow vulnerability that might lead to denial o
NDJSON injection in Wazuh Manager before 5.0.0-beta3 lets any enrolled agent smuggle arbitrary OpenSearch bulk operation
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated critical severity (C
Authenticated remote code execution in Wazuh's Cluster Distributed API (DAPI) lets any peer holding the shared cluster k
Privilege escalation in Wazuh Manager versions 3.9.0 through 4.14.2 allows authenticated cluster nodes to achieve unauth
Path-traversal-driven remote code execution in Wazuh 4.3.0 through 4.14.5 (and 5.0.0-beta1/beta2) lets a cluster peer th
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today