CVE-2026-74033 in Wazuh
Summary
by MITRE • 10/13/2026
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path, bypassing REST validation and RBAC to delete files like rbac.db.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Wazuh versions ranging from 4.1.1 up to but not including 4.14.8 represents a critical security flaw within the centralized management architecture of the platform, specifically targeting the internal communication channels between cluster nodes. This issue is classified as a path traversal vulnerability, which falls under CWE-22 in the Common Weakness Enumeration standard. The core technical defect resides in two specific CDB list handlers: get_lists() and delete_list_file(). These functions are responsible for managing rule lists and other configuration files that dictate how Wazuh agents interpret security events. In a properly secured environment, these operations should be strictly bound to predefined directories to prevent access to sensitive system resources outside the intended scope. However, due to insufficient input validation on filenames provided through the internal cluster Remote Procedure Call RPC mechanism, an attacker can manipulate file paths using traversal sequences or absolute path specifications. This allows the execution of arbitrary read or delete operations against files located anywhere on the filesystem where the Wazuh service has permissions, effectively bypassing the intended directory isolation controls.
The operational impact of this vulnerability is severe because it exploits the trust relationship between cluster nodes in a distributed deployment. In typical Wazuh deployments, master and worker nodes communicate via an internal RPC channel that assumes all participating agents are trusted entities within the same administrative domain. An attacker who has compromised a single cluster worker node can leverage this vulnerability to escalate their privileges or cause significant damage by interacting directly with the master node's file system through these handlers. By sending specially crafted traversal filenames, the attacker can read sensitive configuration files, potentially exposing network topology, agent keys, and security policies. More critically, they can delete essential database files such as rbac.db, which stores Role-Based Access Control information. The destruction of this file would disrupt authentication and authorization mechanisms across the entire cluster, leading to a denial of service or allowing unauthorized access if the system reverts to default insecure states upon restart.
This attack vector is particularly dangerous because it bypasses both REST API validation layers and RBAC enforcement mechanisms that are typically applied at the user-facing interface level. The internal RPC path operates with higher privileges and fewer restrictions than external APIs, assuming integrity of inputs from other cluster members. Consequently, an attacker does not need to authenticate as a high-privileged administrator if they have already gained foothold on any worker node. This aligns with ATT&CK technique T1083 File and Directory Discovery for reconnaissance or T1485 Data Destruction for impact scenarios, depending on whether the goal is information gathering or sabotage. The ability to delete rbac.db specifically targets the integrity of access controls, potentially rendering the security monitoring platform inoperable or allowing lateral movement within the monitored environment by removing restrictions that would otherwise limit an attacker's actions.
Mitigation strategies must prioritize immediate patching and architectural hardening. Organizations running affected versions should upgrade Wazuh to version 4.14.8 or later as soon as possible, as this release contains the necessary code fixes to sanitize file paths within the get_lists() and delete_list_file() handlers. Until patches are applied, administrators should implement network segmentation to restrict RPC traffic between cluster nodes to only authorized IP addresses using firewall rules. Additionally, running Wazuh services with minimal required filesystem permissions can limit the blast radius of such an attack; ensuring that the service account does not have write access to critical system directories or database files outside its designated data folder provides a layer of defense in depth. Regular auditing of cluster node integrity and monitoring for unusual file modification events on master nodes can also help detect exploitation attempts early, although prevention through patching remains the most effective control against this specific path traversal flaw.