Wazuh Manager EUVD-2026-98682

Exploitation requires the attacker to possess the Wazuh cluster key and operate as a cluster worker able to send DistributedAPI requests to the manager - i.e., a multi-node cluster deployment where a worker node or the shared cluster key has been compromised or is attacker-controlled. The specific trigger is passing an unvalidated filename containing traversal sequences to the get_list_file helper (CDB-list retrieval path). Limiting factors: the PR:H barrier (cluster key is a privileged shared secret), relevance only to clustered Wazuh Manager installations (single-node deployments without cluster workers are not meaningfully exposed), affected versions 4.1.1 up to but not including 4.14.8, and impact limited to reading files readable by the wazuh user (no write/modify or availability effect).

This is a moderate, authentication-gated information-disclosure flaw rather than a drop-everything priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N, 6.9 MEDIUM) is internally consistent with the description: network-reachable, low complexity, but requiring high privilege (PR:H) - namely possession of the Wazuh cluster key - and delivering confidentiality-only impact (VC:H, no integrity or availability effect). No EPSS score, KEV listing, or public POC is present in the supplied intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this materially lowers near-term risk versus a high-CVSS network-unauthenticated bug. The real severity is contingent on the trust placed in the cluster key: because the flaw lets a malicious or compromised worker read client.keys and the ossec.conf cluster key itself, successful exploitation enables privilege/lateral escalation across the cluster, which is why confidentiality impact is rated high despite the high privilege barrier. Net assessment: a credible post-compromise/insider-threat escalation vector in multi-node Wazuh deployments, but not a mass-exploitable internet-facing issue; prioritize patching for clustered manager fleets, lower urgency for single-node installs.

An attacker who has obtained a Wazuh cluster key (e.g., via a compromised worker node or leaked configuration) joins the cluster and issues a DistributedAPI request to the vulnerable get_list_file helper with a filename containing path-traversal sequences. The manager returns the contents of arbitrary wazuh-readable files such as client.keys and ossec.conf, exposing agent secrets and the cluster key for further lateral movement. No public exploit code is identified in the supplied data, and exploitation requires the attacker to already hold the cluster key (PR:H).