CVE-2026-93347 in Wazuh
Summary
by MITRE • 10/13/2026
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read client.keys, ossec.conf with the cluster key, and other wazuh-readable files.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Wazuh versions prior to 4.14.8 represents a critical path traversal flaw located within the get_list_file helper function. This component is responsible for managing file operations during distributed agent-manager communications. The core technical deficiency lies in the insufficient validation of filename parameters passed by cluster workers. When a worker node initiates a request through the DistributedAPI, it provides a target filename that the manager processes without adequately sanitizing directory traversal sequences such as dot-dot-slash or encoded variants thereof. This lack of input verification allows an attacker to manipulate the file path resolution logic, causing the system to access files outside the intended secure directory boundaries.
The operational impact of this vulnerability is severe due to its potential for unauthorized data exfiltration and credential theft. An adversary who possesses a valid cluster key can exploit this flaw by crafting specific DistributedAPI requests that include maliciously constructed filenames. By doing so, they can read sensitive configuration files stored on the manager node. The most critical targets accessible through this vector include client.keys, which contain unique identifiers and authentication keys for agents, as well as ossec.conf, which holds cluster configuration details including additional cryptographic keys. Access to these files effectively compromises the integrity of the entire monitoring infrastructure, allowing an attacker to impersonate legitimate agents or disrupt security operations by altering configurations.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as it involves accessing resources outside the intended scope due to inadequate path canonicalization. Furthermore, in the context of the MITRE ATT&CK framework, this exploit technique corresponds to T1083: File and Directory Discovery, where an attacker explores the file system to locate sensitive information for subsequent exploitation or lateral movement. The ability to read arbitrary files also facilitates further attacks such as credential harvesting, which maps to T1552: Unsecured Credentials, particularly when targeting configuration files that store plaintext secrets or keys.
Mitigation strategies must prioritize immediate software updates and strict access controls. Organizations running affected versions of Wazuh should upgrade to version 4.14.8 or later, where the path traversal issue has been resolved through improved input validation mechanisms. In environments where patching is not immediately feasible, network segmentation can help isolate manager nodes from untrusted worker networks, ensuring that only authorized and verified cluster keys are accepted for API requests. Additionally, implementing strict file system permissions on sensitive configuration files like ossec.conf and client.keys adds a layer of defense in depth by restricting read access to the specific service account running Wazuh, thereby limiting the impact even if an application-level vulnerability is exploited.