ZDI-26-527: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI discloses CVE-2026-44901, a 9.9-rated deserialization RCE in Wazuh cluster DAPI requiring low-privileged code on a worker node.
55
CVE-2026-44901
Deserialization-of-Untrusted-Data RCE in Wazuh Cluster Distributed API
- CVSS 3.1
- 8.4 high
- EPSS
- <1%p55
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-44901 is a deserialization flaw (CWE-502) in AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py of the Wazuh security platform, where the sort_casting field in a cluster worker's JSON response is trusted without validation. During a distributed API (DAPI) merge across a Wazuh cluster, attacker-controlled type names are resolved through Python builtins without an allowlist, so a compromised worker can set sort_casting to exec and embed Python source in affected_items. When the master node merges responses from multiple nodes, it executes the injected payload as root, giving the attacker full confidentiality, integrity, and availability impact on the master (CVSS 8.4, scope changed). Only deployments running Wazuh 4.0.0 through 4.14.5 or 5.0.0 pre-release versions before 5.0.0-beta2 in multi-node cluster mode are exposed, and exploitation requires a worker node to already be compromised (adjacent network, high privileges). No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS estimates a 0.4% probability of exploitation in the next 30 days.
What to do: Upgrade Wazuh 4.x deployments to 4.14.6 or later, and 5.x deployments to 5.0.0-beta2 or later. Until patched, restrict access to cluster/DAPI communication between nodes and treat any compromised worker as capable of achieving root code execution on the master. With no public PoC and low EPSS, standard patch cycles are acceptable, but cluster operators should prioritize the update because a single worker compromise can escalate to full master takeover as root.
| Product | Affected |
|---|---|
| Wazuh (threat prevention, detection, and response platform) | 4.0.0 through 4.14.5 (fixed in 4.14.6) |
| Wazuh (threat prevention, detection, and response platform) | 5.0.0 pre-release versions before 5.0.0-beta2 (fixed in 5.0.0-beta2) |
Estimated exposure
large≈ tens of thousands of Wazuh installations, of which only multi-node cluster deployments with a compromised worker are exploitable — Wazuh is one of the most widely deployed open-source SIEM/XDR platforms with a large community install base, but exploitation is limited to multi-node cluster setups where a worker node is already compromised, so the realistic exposed…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sort_casting field in a cluster worker's JSON response. During a distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compromised worker can set sort_casting to exec and place Python source in affected_items, causing the master to execute the payload as root when responses from multiple nodes are merged. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.