CVE-2026-25770 in Wazuh
Summary
by MITRE • 03/17/2026
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privilege escalation vulnerability exists in the Wazuh Manager's cluster synchronization protocol. The `wazuh-clusterd` service allows authenticated nodes to write arbitrary files to the manager’s file system with the permissions of the `wazuh` system user. Due to insecure default permissions, the `wazuh` user has write access to the manager's main configuration file (`/var/ossec/etc/ossec.conf`). By leveraging the cluster protocol to overwrite `ossec.conf`, an attacker can inject a malicious `<localfile>` command block. The `wazuh-logcollector` service, which runs as root, parses this configuration and executes the injected command. This chain allows an attacker with cluster credentials to gain full Root Remote Code Execution, violating the principle of least privilege and bypassing the intended security model. Version 4.14.3 fixes the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 03/21/2026
The vulnerability CVE-2026-25770 represents a critical privilege escalation flaw in the Wazuh security platform that affects versions 3.9.0 through 4.14.2. This vulnerability exploits the cluster synchronization protocol implemented by the wazuh-clusterd service, which is designed to facilitate communication between Wazuh manager nodes in a distributed environment. The flaw stems from inadequate access controls within the cluster protocol implementation, allowing authenticated cluster nodes to perform arbitrary file writes to the manager's filesystem with the privileges of the dedicated wazuh system user. This represents a fundamental breakdown in the platform's security architecture where the intended isolation between cluster nodes is compromised.
The technical exploitation pathway begins with the insecure default permissions assigned to the wazuh user account, which grants write access to the critical manager configuration file located at /var/ossec/etc/ossec.conf. This configuration file serves as the central point of control for the Wazuh manager's operations and contains the directives that govern how various components interact with the system. Attackers can leverage the cluster protocol to overwrite this configuration file with malicious content, specifically injecting a crafted <localfile> command block that executes arbitrary commands. The vulnerability chain becomes particularly dangerous because the wazuh-logcollector service, which operates with root privileges to ensure proper log collection and processing, parses the modified configuration file and executes the injected commands with elevated permissions. This demonstrates a classic privilege escalation attack vector where a lower-privilege authenticated user can leverage a system component to achieve root access.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it fundamentally undermines the security model of the Wazuh platform and creates a complete compromise scenario for affected systems. Organizations utilizing Wazuh clusters are at risk of full system takeover when attackers gain access to cluster credentials, which typically require network-level access and authentication. The vulnerability affects the principle of least privilege by allowing an attacker to execute commands with root privileges through a configuration file modification that bypasses normal access controls. From an ATT&CK perspective, this vulnerability maps to privilege escalation techniques and potentially command and control operations, as it enables persistent access to systems through the execution of arbitrary commands. The attack surface is particularly concerning in environments where Wazuh clusters are deployed across multiple nodes, as compromising one node can potentially lead to access to the entire cluster infrastructure.
The mitigation strategy centers on upgrading to Wazuh version 4.14.3 or later, which includes fixes addressing the insecure file write permissions and cluster protocol validation. Organizations should also implement additional security measures such as restricting cluster node access through network segmentation, implementing strict authentication controls, and monitoring cluster communication for suspicious activities. The fix addresses the root cause by ensuring that the wazuh user account no longer has write permissions to critical system configuration files, thereby preventing the initial exploitation vector. Additionally, security practitioners should consider implementing runtime monitoring of the wazuh-logcollector service to detect anomalous command execution patterns that might indicate exploitation attempts. This vulnerability highlights the importance of proper privilege management in distributed security systems and serves as a reminder of the critical need for regular security updates in open source platforms that handle sensitive security data. The issue also aligns with CWE-276, which addresses improper file permissions, and demonstrates how inadequate access control can lead to severe privilege escalation vulnerabilities in security infrastructure platforms.