An attacker with authenticated cluster credentials can exploit the wazuh-clusterd service on the Wazuh Manager to write arbitrary files with the wazuh system user’s permissions. Because the wazuh user has write access to the main configuration file \/var\/ossec\/etc\/ossec.conf, a malicious <localfile> command can be injected. The wazuh‑logcollector service, running as root, parses this configuration and executes the injected commands, resulting in full root privilege escalation. The weakness involves insecure default permissions (CWE‑732), improper privilege escalation (CWE‑269), and path traversal (CWE‑22).

The vulnerability affects Wazuh Manager versions from 3.9.0 through 4.14.2, where cluster synchronization allows file writes with wazuh user ownership. Version 4.14.3 includes a fix that blocks unauthorized writes and removes the insecure default permissions.

With a CVSS score of 9.1 the threat is classified as critical. The EPSS score of under 1% indicates limited known exploitation, and the vulnerability is not yet listed in the CISA KEV catalog. Nonetheless, because any cluster node with valid credentials can initiate the exploit, the risk to systems with active cluster configurations is high. The attack requires only authenticated cluster access; no further privilege escalation steps are needed to achieve root RCE.