Wazuh CVE-2026-49441

Exploitation requires that Wazuh is deployed in cluster mode and that the attacker is (or controls) an authenticated cluster peer holding the shared Fernet encryption key - this maps to the CVSS PR:H. The attacker must send a crafted 'extra-valid' sync archive whose files_metadata.json contains a non-merged entry with a traversal file_path escaping the directory selected by cluster_item_key. Limiting factors: standalone/non-clustered managers are not affected; the shared key must be known, so a fully external unauthenticated attacker cannot trigger it directly; and meaningful impact (root RCE) depends on overwriting ossec.conf followed by a manager service reload.

This is a genuine high-severity issue but with a meaningful precondition gate. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1) reflects network reach, low complexity, and full CIA impact with scope change, but PR:H is the pivotal metric: the attacker must already be an authorized cluster peer possessing the shared Fernet key. That means the realistic threat is a compromised or rogue worker node, or an insider, rather than an anonymous internet attacker. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation - this reads as a targeted, insider/lateral-movement risk rather than a mass-exploitation event. The high CVSS is justified by the RCE-as-root outcome, but prioritization should weight the fact that exploitation presupposes cluster membership; environments running standalone (non-clustered) managers are not exposed. Net: patch promptly on clustered deployments, but this is not an internet-facing spray-and-pray bug.

An attacker who has compromised a Wazuh worker node (or otherwise obtained the shared cluster Fernet key) crafts an extra-valid sync archive whose files_metadata.json sets file_path to traverse outside the intended sync directory. The master accepts it and overwrites /var/ossec/etc/ossec.conf with a configuration that defines an attacker-controlled command run as root; on the next manager reload the command executes, yielding root code execution on the master. No public POC is currently identified, but the fixing commit publicly discloses the exact flawed logic.