Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires possession of the cluster key so PR:H; network-delivered low-complexity file write yields root RCE with scope change and full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code execution as root. During cluster file synchronization, the non-merged branch of update_master_files_in_worker() moves each staged file to a destination derived only from safe_join(), which confines the path to /var/ossec but never verifies that the file lands in the directory declared by its cluster_item_key. Because the destination check present on the primary node and on the worker's merged branch was not applied, a peer can place files at attacker-chosen locations under /var/ossec, including paths that are executed as root, and the delete branch has the same gap. This is an incomplete fix for CVE-2026-30893, which addressed traversal outside /var/ossec but left this path able to redirect files anywhere within it. This issue is fixed in version 4.14.7.
AnalysisAI
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running versions 4.4.0 through 4.14.6. A peer that possesses the shared cluster key can abuse the file-synchronization routine to drop, overwrite, or delete files at attacker-chosen paths under /var/ossec - including scripts executed as root - because the worker's non-merged sync branch never verifies that a synced file matches the directory declared by its cluster_item_key. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold the Wazuh cluster key and act as a synchronizing cluster peer (master/worker relationship), and the target must be a multi-node Wazuh cluster running 4.4.0-4.14.6 with worker nodes; the flaw lives specifically in the non-merged branch of update_master_files_in_worker() (and its delete branch). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent and point to a genuine high-severity issue for clustered Wazuh deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Wazuh 4.14.7, which adds the missing cluster_item_key directory-confinement checks in overwrite_or_create_files() for both the write/overwrite and delete paths. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Wazuh deployments and identify any running affected versions (4.4.0 through 4.14.6). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in version
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or dele
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-pr
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that al
Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuiti
Wazuh Manager in Wazuh through 4.1.5 is affected by a remote Integer Underflow vulnerability that might lead to denial o
NDJSON injection in Wazuh Manager before 5.0.0-beta3 lets any enrolled agent smuggle arbitrary OpenSearch bulk operation
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today