Wazuh Manager EUVD-2026-98671

Requires a multi-node Wazuh cluster deployment AND prior compromise of a cluster worker node - the attacker must be able to send messages over the internal cluster RPC channel to the master. The flaw is reachable only through that internal RPC path, which bypasses the REST API's filename validation and RBAC enforcement; the equivalent REST endpoints are not vulnerable because they validate paths. Limiting factors: single-node deployments are not exposed, the attacker needs adjacent network position inside the cluster plus worker-level privileges (PR:H), and no user interaction is required once that foothold exists. This is a lateral-escalation/post-compromise primitive, not an externally exploitable entry point.

This is a genuine but conditional risk rather than a drive-by critical. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N, score 8.4) is internally consistent with the description: exploitation is adjacent-network and requires HIGH privileges - specifically a compromised cluster worker node - so PR:H correctly reflects that the attacker must already hold a foothold inside the Wazuh cluster. No EPSS score, KEV listing, or POC was provided in the input, so exploitation likelihood signals are absent; there is no public exploit identified at time of analysis and no evidence of active exploitation. The high VC:H/VI:H (read and delete of master files including rbac.db) is serious because deleting the RBAC database can degrade the security controls of the entire deployment, but the required precondition (pre-existing worker compromise) means this is a post-exploitation / lateral-escalation primitive rather than an initial-access vulnerability. Net: real priority for multi-node cluster operators to patch, but not an internet-facing unauthenticated emergency. Note the vector supplied is CVSS 4.0 only; no 3.1 vector was provided for cross-checking.

An attacker who has already compromised a Wazuh cluster worker node sends crafted RPC messages to the master containing traversal (../) or absolute-path filenames targeting the get_lists() and delete_list_file() CDB handlers. Because the internal cluster RPC path bypasses the REST API's validation and RBAC checks, the attacker reads or deletes arbitrary master files such as rbac.db, undermining access controls across the deployment. No public exploit was identified at time of analysis.