This vulnerability allows a cluster peer that shares the Wazuh Fernet key to inject an arbitrary tmp_file path into the DistributedAPI.send_tmp_file function. Because the input is concatenated with WAZUH_PATH without canonicalization or confinement, the attacker can cause the master to read any readable file on the manager node, such as private_key.pem. Access to that private key lets the attacker forge administrator REST API tokens offline, granting full administrative privileges without creating an account. The weakness is a classic path traversal flaw (CWE-73).

Affected products are the Wazuh platform from version 4.0.0 through 4.14.6 and from version 5.0.0‑beta3. The vulnerability exists in the distributed API component located in framework/wazuh/core/cluster/dapi/dapi.py and is fixed in releases 4.14.6 and 5.0.0‑beta3.

Based on the CVSS base score of 9.1, this issue is considered Critical. The EPSS score is not available, but the lack of KEV listing does not reduce the likelihood that private clusters may be targeted. An attacker who can insert a malicious tmp_file value – for example by compromising a cluster peer or injecting the value over an existing trusted connection – can read arbitrary files from the master node and then forge admin REST API tokens, effectively gaining remote administrative control. Because the flaw only requires the ability to send a DistributedAPI message and does not rely on local privileges or special network exposure, the risk to distributed installations is high once a peer is compromised.