Wazuh CVE-2026-61800

Exploitation requires the attacker to hold the Wazuh cluster key and act as a synchronizing cluster peer (master/worker relationship), and the target must be a multi-node Wazuh cluster running 4.4.0-4.14.6 with worker nodes; the flaw lives specifically in the non-merged branch of update_master_files_in_worker() (and its delete branch). The limiting factors are significant: this is not exploitable against a default single-node install, it demands possession of the cluster secret (reflected as PR:H), and it targets the worker node's file-sync path rather than any externally exposed service. Given valid cluster-key access, no additional user interaction is required (UI:N) and complexity is low (AC:L), so an attacker meeting the cluster-membership prerequisite can reliably write to attacker-chosen paths under /var/ossec.

The signals are largely consistent and point to a genuine high-severity issue for clustered Wazuh deployments. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C, C:H/I:H/A:H, score 9.1) reflects network-reachable, low-complexity exploitation that yields root code execution with scope change, but it is gated by PR:H - the attacker must already hold the cluster key or control a peer node, which meaningfully narrows the realistic attacker population to insiders, a compromised worker/master, or an attacker who has stolen the cluster secret. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active or opportunistic exploitation; the practical risk is scoped to organizations running multi-node Wazuh clusters where the cluster key could be exposed. Because successful exploitation grants root RCE across nodes, any operator running an affected clustered deployment should treat patching to 4.14.7 as urgent even though single-node deployments and installations with a well-protected cluster key are at substantially lower immediate risk. The fact that this is an incomplete fix for CVE-2026-30893 slightly raises concern that the code path is under scrutiny and could attract researcher attention.

An attacker who has obtained the Wazuh cluster key - for example by compromising one node or exfiltrating the shared secret - connects as a cluster peer and, during file synchronization, sends a staged file whose cluster_item_key claims a benign directory while the actual path points to an executable location such as /var/ossec/active-response/bin. The worker's non-merged branch writes the malicious script there without validating the declared directory, and it is later executed as root. No POC was provided, but the low attack complexity (AC:L) means exploitation is straightforward once cluster-key access is held.