Do Son 
TL;DR
Three critical Wazuh manager vulnerabilities now have public advisories and proof-of-concept exploit code. Each scores CVSS 9.1 and abuses the cluster protocol. Any peer holding the shared Fernet key can reach root code execution, read secret files, or forge admin tokens on the master.
Why These Wazuh Vulnerabilities Matter
Wazuh is a widely used open-source security platform, and its GitHub repository has more than 16,000 stars. Teams run it as a SIEM to detect threats across servers, containers, and cloud workloads.
These Wazuh vulnerabilities turn that defensive tool into a target. The master node coordinates the whole deployment, so a compromise there affects every connected agent. Because the researchers published working exploit code, the barrier to abuse is now low.
The Fernet key is easier to obtain than many teams assume. It sits inside ossec.conf, so anyone with a backup, a snapshot, or a leaked config may hold it. Once an attacker has that key, all three flaws open.
How the Attacks Work
All three flaws share one root cause: the cluster protocol trusts peer-supplied file paths. The shared Fernet key authenticates cluster membership, but the maintainers note it “should not grant arbitrary filesystem write access across all nodes.”
CVE-2026-49441: Arbitrary File Write
The first bug lets a peer choose a destination path from crafted sync metadata. As a result, the attacker overwrites the master’s central ossec.conf file. A later restart then runs attacker commands as root through wazuh-logcollector.
CVE-2026-48162: Arbitrary File Read
The second flaw injects a path into a temporary-file field. Consequently, the master reads any file the wazuh user can open. Stealing the REST API signing key lets an attacker forge valid admin tokens offline, with no account and no audit trail.
This foothold is stubborn. Rotating the cluster Fernet key does not revoke a stolen signing key. Instead, defenders must rotate the API JWT keypair itself, which is not a routine task.
CVE-2026-48024: Merged-File Path Traversal
The third issue hides traversal sequences inside a merged sync archive. This bypasses an earlier patch and writes files outside the intended folder. Overwriting ossec.conf again yields root command execution on reload.
Affected Versions
CVE-2026-49441 affects Wazuh manager 4.3.0 and later. Both CVE-2026-48162 and CVE-2026-48024 affect 4.0.0 and later. All three build on the earlier CVE-2026-25770 cluster weakness.
The reporter verified each exploit against a stock 4.14.5 container. No in-the-wild exploitation has been confirmed yet.
Patch and Mitigation Steps
Upgrade every Wazuh manager to version 4.14.6 without delay. You can review the technical details in the official advisories for CVE-2026-49441, CVE-2026-48162, and CVE-2026-48024.
If you cannot patch at once, restrict network access to the cluster port (default TCP/1516). Also treat the Fernet key as a high-value secret, rotate it, and rotate the API JWT keypair after any suspected exposure.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
