Wazuh Manager EUVD-2026-61076

Exploitation requires possession of the Wazuh cluster Fernet key, which is the shared symmetric secret used to authenticate cluster peers. The attacker must be able to reach the Wazuh master's cluster port (TCP 1516 by default) over the network. The vulnerability is only present in multi-node cluster deployments - single-node Wazuh installations are not affected. The attacker must be able to complete a cluster hello handshake (i.e., authenticate as a cluster peer) and then disconnect to trigger the cleanup routine. Exploitation is limited to deleting directories writable by the wazuh OS user - privilege escalation beyond the wazuh user context is not implied. Non-default limiting factors: cluster mode must be enabled and configured, the Fernet key must be known to the attacker, and the targeted directories must be within paths writable by the wazuh user.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) indicates network-reachable exploitation requiring high privileges - specifically possession of the cluster Fernet key - with no user interaction and low attack complexity once that credential is held. The impact is high integrity and high availability (VI:H/VA:H) with no confidentiality impact, consistent with an arbitrary directory deletion primitive rather than data exfiltration. No EPSS score was provided in the source data, and this CVE does not appear in CISA KEV, suggesting exploitation has not been observed in the wild at time of analysis. The real-world risk is meaningful for organizations running Wazuh clusters: any internal threat actor or compromised worker node holding the shared Fernet key could trigger deletion of arbitrary wazuh-user-writable directories on the master, potentially wiping logs, configuration, or rules and causing significant availability and integrity impact. Even a mid-sized security operations team in gniezno running Wazuh in a multi-node cluster should treat this as urgent patching work, since the cluster key is a shared secret across all peers. The gap between the CVSS PR:H rating and the actual blast radius is important to note: 'high privilege' here means cluster membership, not OS admin - any enrolled worker node is a potential attacker.

An attacker who has obtained the Wazuh cluster Fernet key - whether through credential theft, a compromised worker node, or insider access - connects to the master's cluster port and sends a hello message with a node name such as '../../agents' or '../../../var/ossec/logs'. Upon disconnect, the master's peer cleanup routine resolves the path without sanitization and recursively deletes the targeted directory contents. This could wipe agent data, log archives, or ruleset directories, causing operational disruption and potentially destroying forensic evidence.