CVE-2026-74038 in Wazuh
Summary
by MITRE • 08/18/2026
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in Wazuh versions prior to 4.14.6 represents a critical security flaw rooted in insufficient input validation during the agent enrollment process. This issue specifically affects the authentication mechanism, allowing unauthenticated remote attackers to exploit the system by submitting maliciously crafted identifiers containing dot-sequence characters such as double dots. The core of this vulnerability lies within two specific functions: OS_IsValidName and delete_diff. While OS_IsValidName is intended to validate agent names against a set of acceptable character patterns, it fails to adequately sanitize or reject sequences that could be interpreted as directory traversal indicators when processed further down the execution chain. This oversight creates an opening for attackers to bypass standard security controls by leveraging path manipulation techniques inherent in file system operations.
The operational impact of this vulnerability is severe and directly results in a denial of service condition for Wazuh services. When an attacker successfully enrolls an agent using a name containing traversal sequences, the unsafe path concatenation logic within the delete_diff function resolves these sequences to access parent directories rather than staying within the intended subdirectories. Consequently, this leads to the accidental deletion of critical subdirectories within the queue directory structure. Since the queue is essential for storing and processing security event data, its corruption or removal causes all Wazuh services that depend on it to stop functioning immediately. This effectively halts the monitoring and detection capabilities of the entire platform until manual intervention occurs.
From a technical classification perspective, this vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, as the application fails to restrict file operations to an expected location based on user input. Furthermore, it relates to CWE-78 Improper Neutralization of Special Elements used in an OS Command or Insecure Temporary File handling depending on the specific implementation details of how the path is resolved and deleted. The attack vector falls under MITRE ATT&CK technique T1496 Remote File Copy if viewed through the lens of data destruction, but more accurately reflects destructive actions associated with privilege escalation or system compromise scenarios where availability is targeted. It highlights a common pitfall in software development where input validation at one stage does not guarantee safety during subsequent file system operations that assume sanitized inputs.
Mitigation strategies must focus on immediate patching and robust defensive coding practices. The primary remediation step is to upgrade Wazuh to version 4.14.6 or later, which addresses the flaws in OS_IsValidName and delete_diff by implementing stricter validation rules for agent names and ensuring that path concatenation operations are safely bounded within designated directories. For environments where immediate patching is not feasible, network-level controls should be employed to restrict access to the enrollment port exclusively to trusted IP ranges or internal networks only. Additionally, administrators should implement strict file system permissions on critical Wazuh directories to limit the potential blast radius of any accidental deletion events. Regular audits of input validation logic across all user-facing endpoints are recommended to prevent similar traversal vulnerabilities from being introduced in future updates.