A low‑privilege API user can retrieve the cleartext cluster key from the GET /cluster/local/config endpoint because the endpoint lacks the mask_sensitive_config decorator that normally redacts sensitive configuration values. The cluster key authenticates and encrypts traffic between Wazuh nodes, and its disclosure allows an attacker to satisfy the authentication precondition for the cluster‑peer remote code execution chains documented in earlier advisories, thereby potentially compromising the entire cluster. This represents a confidentiality and future compromise vulnerability as specified by CWE-200 and CWE-522.

Wazuh security platform versions 4.14.0 through 4.14.6 carry the flaw. The default readonly or cluster_readonly roles are explicitly denied update‑config permission but are still granted cluster:read permission, which allows them to hit the unredacted endpoint and receive the full cluster key.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. An attacker would exploit the vulnerability by sending a GET request to /cluster/local/config while authenticated as a low‑privilege user; the exposed key then provides the necessary credential to impersonate a cluster node and inject malicious traffic to other nodes. Although the direct exploit is relatively simple, the resulting ability to compromise the cluster lands the vulnerability in a higher attack impact zone due to the potential for subsequent remote code execution.