Wazuh enables distributed threat detection through a cluster of nodes that collaboratively process data. Between versions 4.0.0 and 4.14.6, and during the beta release of 5.0.0, the function that merges data from worker nodes trusts a JSON field called sort_casting supplied by those workers. An attacker who can influence a worker node can set that field to the value exec and include arbitrary Python source code in the affected_items payload. The merge routine resolves the type name via Python builtins without whitelisting, so the master node executes the payload as root. This uncontrolled deserialization allows an attacker to run arbitrary code on the master, thereby fully compromising the system. The weakness is a classic instance of CWE‑502: Deserialization of Untrusted Data.

The vulnerability affects the Wazuh open‑source platform, specifically versions 4.0.0 up through 4.14.6 and the beta release 5.0.0‑beta2. Any configuration that uses a cluster with multiple worker nodes and enables the distributed API will be susceptible if no mitigation is applied.

The CVSS score of 8.4 indicates high severity. The EPSS score is currently not available, and the issue is not listed in the CISA KEV catalog, but the exploitation risk remains significant because the flaw allows code execution on the master node when a single worker can be compromised. The vector is likely to be a malicious or compromised worker node that sends a crafted JSON response; alternatively, an attacker could exploit a node that is remote in the cluster. The flaw is fixed in Wazuh 4.14.6 and 5.0.0‑beta2, but systems running older versions remain exposed.