The vulnerability allows a malicious cluster worker to overwrite protected configuration files on the Wazuh manager, specifically ossec.conf and agent.conf. By exploiting a trailing‑slash basename bypass and a missing enforcement guard in MasterHandler.process_files_from_worker, an attacker who controls a worker can manipulate those files with root privileges. This results in the ability to execute arbitrary code on the manager and every connected agent, delivering full remote code execution across the entire cluster.

The issue affects Wazuh Manager versions from 3.9.0 up to, but not including, 4.14.8. Any environment running one of these releases and participating in a Wazuh cluster can be impacted, including all agents that rely on the manager’s configuration files.

With a CVSS score of 9.4 the vulnerability is deemed critical. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to control a cluster worker or compromise a worker’s host. Once the worker is trusted, it can overwrite the protected files, giving the attacker root privileges on the manager and the ability to affect all agents. The lack of a network segregation or authentication measure for workers dramatically increases the risk of the attack vector, making the flaw highly exploitable in environments where worker nodes are not strictly isolated from the manager.