EUVD-2026-62555Severity by source
AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
AV:A because worker-to-master communication is cluster-adjacent; PR:H because worker node compromise is required; S:C because trust boundary between worker and master is crossed yielding root RCE.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sort_casting field in a cluster worker's JSON response. During a distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compromised worker can set sort_casting to exec and place Python source in affected_items, causing the master to execute the payload as root when responses from multiple nodes are merged. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
AnalysisAI
Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node, exploiting unsafe Python builtin resolution in the distributed API merge path. Affected versions span 4.0.0 through 4.14.5 and 5.0.0-beta1; the vulnerable code in framework/wazuh/core/results.py called getattr(builtins, type_) with attacker-supplied strings from worker JSON responses, enabling exec or eval injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is mechanically trivial once a worker node is controlled, with the payload executing as root on the master.
Technical ContextAI
The flaw resides in AffectedItemsWazuhResult.decode_json() and the merge() function in framework/wazuh/core/results.py (CPE: cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*). During distributed cluster API operations, the Wazuh master aggregates JSON responses from worker nodes; each response includes a sort_casting field specifying Python type names used to cast sort keys. The original code resolved these names directly via getattr(builtins, type_), meaning any Python builtin - including exec, eval, compile, or __import__ - was reachable. Placing exec in sort_casting and Python source code in affected_items caused the master to invoke the payload during merge. This is a textbook CWE-502 (Deserialization of Untrusted Data) pattern: network-controlled data drives a code-resolution path with no allowlist. The fix confirmed by PR #35757 and commit b29849f8 introduces ALLOWED_TYPES = {'int', 'float', 'str', 'bool'} with strict validation at both decode and merge stages, rejecting any type name outside that set.
RemediationAI
Upgrade to Wazuh 4.14.6 (https://github.com/wazuh/wazuh/releases/tag/v4.14.6) or 5.0.0-beta2 (https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2); these releases introduce a strict sort_casting allowlist validated at both decode and merge stages, confirmed via PR #35757 and commit b29849f8. If immediate patching is not possible, restrict network-layer access between worker and master nodes to trusted, segmented infrastructure so that only legitimate worker hosts can reach the master's cluster communication port - this does not eliminate the vulnerability but raises the bar for exploitation by requiring network-level control first. Additionally, audit all cluster worker nodes for indicators of prior compromise before trusting cluster integrity, as a previously compromised worker may have already staged a payload. There is no configuration toggle to disable the vulnerable code path without patching; the merge operation is fundamental to clustered API functionality.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today