CVE-2026-49441

Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager

View on CVE.org

Published Aug 19, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusts a peer-controlled file_path key from files_metadata.json. The destination is joined to WAZUH_PATH without proving that it remains inside the directory selected by cluster_item_key. A cluster peer holding the shared Fernet key can upload a crafted extra-valid archive and overwrite security-sensitive files such as /var/ossec/etc/ossec.conf. Replacing ossec.conf can configure root-executed commands and lead to code execution after a service reload. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.

Analysis

Technical impact

Wazuh's non‑merged process_files_from_worker() branch allows a cluster peer that controls the file_path key in files_metadata.json to specify any file path. The system concatenates this path with WAZUH_PATH without validating containment, enabling overwriting critical files such as /var/ossec/etc/ossec.conf. Such overwrite can insert malicious root‑executed commands and trigger code execution when the Wazuh service reloads, leading to full system compromise.

Affected Systems

The vulnerability affects Wazuh version 4.3.0 through 4.14.6 and the beta 5.0.0‑beta3 release. Any deployment using the non‑merged process_files_from_worker() branch with a cluster peer sharing the Fernet key is at risk.

Risk and Exploitability

The CVSS score of 9.1 reflects a high‑severity threat. Although the EPSS score is not available, the reliance on a shared Fernet key by a cluster peer provides an authenticated attack vector that can be abused to write arbitrary files. The vulnerability is not yet listed in the CISA KEV catalog, but its potential for code execution warrants immediate attention.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

wazuh

affected

Version	Status	Constraints
`>= 4.3.0, < 4.14.6`	affected	—
`>= 5.0.0-beta1, < 5.0.0-beta3`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:wazuh:wazuh::::::::
	cpe:2.3:a:wazuh:wazuh:5.0.0:beta1::::::
	cpe:2.3:a:wazuh:wazuh:5.0.0:beta2::::::

No data.

Vendor Product Versions

Wazuh

Version	Status	Scheme	Platform
`[4.3.0,4.14.6)`	affected	semver	—
`[5.0.0-beta1,5.0.0-beta3)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Wazuh manager to version 4.14.6 or newer (e.g., 5.0.0‑beta3).
Restrict cluster communication to trusted nodes and verify Fernet key usage.
Regenerate or revoke any compromised Fernet keys and restart affected services.

Generated by OpenCVE AI on August 20, 2026 at 14:01 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.774% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/wazuh/wazuh/commit/7f13682cf5f01f69452f723a608ab2d89cfb2133
https://github.com/wazuh/wazuh/pull/36296
https://github.com/wazuh/wazuh/releases/tag/v4.14.6
https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta3
https://github.com/wazuh/wazuh/security/advisories/GHSA-3v57-hgvj-3vj2

History

Sep 15, 2026 7:30 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:wazuh:wazuh:::::::: cpe:2.3:a:wazuh:wazuh:5.0.0:beta1:::::: cpe:2.3:a:wazuh:wazuh:5.0.0:beta2::::::

Aug 19, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 19, 2026 6:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wazuh Wazuh wazuh
Vendors & Products		Wazuh Wazuh wazuh

Aug 19, 2026 4:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusts a peer-controlled file_path key from files_metadata.json. The destination is joined to WAZUH_PATH without proving that it remains inside the directory selected by cluster_item_key. A cluster peer holding the shared Fernet key can upload a crafted extra-valid archive and overwrite security-sensitive files such as /var/ossec/etc/ossec.conf. Replacing ossec.conf can configure root-executed commands and lead to code execution after a service reload. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.
Title		Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager
Weaknesses		CWE-73
References		https://github.com/wazuh/wazuh/commit/7f13682cf5f01f69452f723a608ab2d89cfb2133 https://github.com/wazuh/wazuh/pull/36296 https://github.com/wazuh/wazuh/releases/tag/v4.14.6 https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta3 https://github.com/wazuh/wazuh/security/advisories/GHSA-3v57-hgvj-3vj2
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}`