Description
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is disabled by any update-config RBAC rule, including an explicit deny. The mask_sensitive_config() decorator applies masking only when _has_update_permissions() returns false, but that gate treats a user as able to update the config whenever a  manager:update_config  or  cluster:update_config  rule exists, without ever checking whether the rule's effect is allow or deny. Because a deny rule is stored as a real entry, a read-only account that is hardened by explicitly denying config edits is counted as having update permission, which turns masking off. A single authenticated GET request to the configuration endpoint with  raw=true  then returns the verbatim ossec.conf XML with  cluster.key  in clear, whereas an otherwise identical account without the deny rule sees the value masked. This issue is fixed in version 4.14.7.
Published: 2026-08-27
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: Confidential Data Exposure
Action: Patch
AI Analysis

Impact

Wazuh’s mask_sensitive_config decorator incorrectly removes sensitive data masking whenever any update-config RBAC rule is present, even if that rule’s effect is a deny. A low‑privilege user who is hardened by an explicit deny on configuration edits is therefore treated as having update permission, causing the configuration API to return the raw ossec.conf XML. When the user requests the configuration with raw=true, the cluster.key is exposed in clear text, allowing the attacker to recover the secret that secures inter‑node communication.

Affected Systems

All installations of the open‑source Wazuh security platform running manager versions 4.14.0 through 4.14.6 are affected. The flaw exists in the manager component that holds cluster configuration and is limited to these versions; versions prior to 4.14.0 or the patched 4.14.7 and later are not impacted.

Risk and Exploitability

The CVSS score of 7.0 reflects high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires only a legitimate low‑privilege login and the presence of an update‑config rule that includes a deny. Once those conditions are met, a single authenticated GET request to the configuration endpoint with raw=true exposes the cluster.key, making exploitation trivial and providing immediate confidentiality compromise.

Generated by OpenCVE AI on August 28, 2026 at 07:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Wazuh installation to version 4.14.7 or later, which restores correct masking logic.
  • If upgrading is delayed, remove or disable update‑config RBAC rules from low‑privilege roles to prevent the incorrect detection of update permission.
  • Restrict the use of the raw=true query parameter on the configuration endpoint for non‑admin users, for example by removing the parameter from the API or by enforcing role‑based restrictions around raw configuration access.

Generated by OpenCVE AI on August 28, 2026 at 07:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Fri, 28 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
First Time appeared Wazuh
Wazuh wazuh
Vendors & Products Wazuh
Wazuh wazuh

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is disabled by any update-config RBAC rule, including an explicit deny. The mask_sensitive_config() decorator applies masking only when _has_update_permissions() returns false, but that gate treats a user as able to update the config whenever a  manager:update_config  or  cluster:update_config  rule exists, without ever checking whether the rule's effect is allow or deny. Because a deny rule is stored as a real entry, a read-only account that is hardened by explicitly denying config edits is counted as having update permission, which turns masking off. A single authenticated GET request to the configuration endpoint with  raw=true  then returns the verbatim ossec.conf XML with  cluster.key  in clear, whereas an otherwise identical account without the deny rule sees the value masked. This issue is fixed in version 4.14.7.
Title Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key
Weaknesses CWE-200
CWE-863
References
Metrics cvssV4_0

{'score': 7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Wazuh Wazuh
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-28T14:52:45.579Z

Reserved: 2026-07-10T20:06:05.616Z

Link: CVE-2026-61783

cve-icon Vulnrichment

Updated: 2026-08-28T14:52:23.409Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-28T00:18:07.997

Modified: 2026-09-15T19:13:26.400

Link: CVE-2026-61783

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T08:15:06Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-863

    Incorrect Authorization