Wazuh up to 4.14.6 Cluster File Synchronization update_master_files_in_worker redirect

Summaryinfo

A vulnerability has been found in Wazuh up to 4.14.6 and classified as problematic. This issue affects the function update_master_files_in_worker of the component Cluster File Synchronization. The manipulation leads to redirect. This vulnerability is referenced as CVE-2026-61800. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Wazuh up to 4.14.6 and classified as problematic. This issue affects the function update_master_files_in_worker of the component Cluster File Synchronization. The manipulation with an unknown input leads to a redirect vulnerability. Using CWE to declare the problem leads to CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Impacted is integrity. The summary by CVE is:

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code execution as root. During cluster file synchronization, the non-merged branch of update_master_files_in_worker() moves each staged file to a destination derived only from safe_join(), which confines the path to /var/ossec but never verifies that the file lands in the directory declared by its cluster_item_key. Because the destination check present on the primary node and on the worker's merged branch was not applied, a peer can place files at attacker-chosen locations under /var/ossec, including paths that are executed as root, and the delete branch has the same gap. This is an incomplete fix for CVE-2026-30893, which addressed traversal outside /var/ossec but left this path able to redirect files anywhere within it. This issue is fixed in version 4.14.7.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-61800 since 07/10/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1204.001 according to MITRE ATT&CK.

Upgrading to version 4.14.7 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Wazuh

Version

• 4.14.0
• 4.14.1
• 4.14.2
• 4.14.3
• 4.14.4
• 4.14.5
• 4.14.6

Website

• Product: https://github.com/wazuh/wazuh/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion