Wazuh up to 4.14.6 Cluster Configuration /cluster/local/config read_config_wrapper missing encryption

Summaryinfo

A vulnerability was found in Wazuh up to 4.14.6. It has been declared as problematic. The impacted element is the function read_config_wrapper of the file /cluster/local/config of the component Cluster Configuration. Such manipulation leads to missing encryption. This vulnerability is listed as CVE-2026-61802. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Wazuh up to 4.14.6. It has been rated as problematic. Affected by this issue is the function read_config_wrapper of the file /cluster/local/config of the component Cluster Configuration. The manipulation with an unknown input leads to a missing encryption vulnerability. Using CWE to declare the problem leads to CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. Impacted is confidentiality. CVE summarizes:

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a masking control, mask_sensitive_config, that redacts sensitive fields such as authd.pass and cluster.key from configuration responses for users who lack update-config permission, and every config-read endpoint carries this decorator except GET /cluster/local/config. That endpoint, backed by read_config_wrapper, is gated only by cluster:read and returns the local node's cluster configuration including the cleartext key, whereas its siblings return the same value masked. As a result, any account with the default readonly or cluster_readonly role, which is explicitly denied update-config precisely so it cannot view secrets, receives the real cluster key. Because the cluster key authenticates and encrypts traffic between cluster nodes, disclosing it to an unprivileged account provides the authentication precondition for the cluster-peer remote code execution chains established by prior advisories. This issue is fixed in version 4.14.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-61802 since 07/10/2026. The exploitation is known to be difficult. The attack may be launched remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1600 by the MITRE ATT&CK project.

Upgrading to version 4.14.7 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Wazuh

Version

• 4.14.0
• 4.14.1
• 4.14.2
• 4.14.3
• 4.14.4
• 4.14.5
• 4.14.6

Website

• Product: https://github.com/wazuh/wazuh/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion