What happened
A critical vulnerability has been identified in Wazuh from version 4.1.1 up to but not including 4.14.8. This flaw, designated as CVE-2026-74043, involves a path traversal vulnerability within the upload_list_file, upload_rule_file, and upload_decoder_file functions of the wazuh-manager component. Malicious cluster workers, possessing the cluster key, can exploit this weakness by sending specially crafted DistributedAPI requests containing ../ sequences in filenames, thereby bypassing validation checks. Such exploits permit an attacker to write files to arbitrary locations on affected systems, potentially leading to severe security breaches. The vulnerability’s severity is classified as critical, with a CVSS base score of 9.0, primarily due to the potential impact on system integrity and confidentiality. The attack requires the attacker to hold high privileges and access an exposed network service, with no user interaction necessary.
Who is affected
Organisations running Wazuh manager versions between 4.1.1 and before 4.14.8 are affected by this vulnerability. The issue impacts systems where the wazuh-manager component is accessible remotely over the network and where cluster keys are in use. Affected deployments include those that have exposed services which may be vulnerable to direct attacks without user involvement. Since the vulnerability hinges on network accessibility and high privileges, any affected infrastructure exposed to untrusted networks poses a significant risk for exploitation.
Recommended actions
Review network access controls to ensure that the Wazuh manager service is properly isolated from untrusted networks and accessible only to trusted sources.
Implement network segmentation and access restrictions to limit exposure of exposed services to known, trusted hosts.
Monitor and review logs for any anomalous requests or activities related to the upload endpoints, especially those containing suspicious path traversal patterns.
Prepare for updates by tracking vendor advisories or security bulletins regarding patches or mitigation measures for the affected versions.
