CVE-2026-48024

Wazuh contains a path traversal flaw (CWE-22) in its cluster synchronization code: unmerge_info() in framework/wazuh/core/cluster/cluster.py builds file paths from peer-controlled merge_type and name values in a merged sync archive, and process_files_from_worker() in master.py does not confine the resulting path to the declared cluster item directory. A malicious or compromised cluster peer holding the cluster's shared Fernet key can supply traversal sequences in files_metadata. or a merged-file header to write arbitrary files on the master, including /var/ossec/etc/ossec.conf. Replacing ossec.conf lets the attacker configure commands that Wazuh runs as root, resulting in remote code execution when Wazuh services reload. Affected versions are 4.0.0 up to (but not including) 4.14.6, plus 5.0.0 beta builds prior to 5.0.0-beta3; the issue is fixed in 4.14.6 and 5.0.0-beta3. The flaw is rated critical (CVSS 9.1) but requires high privileges (a trusted cluster peer with the shared key), and although technical details are public in the vendor's GitHub advisory (EPSS 0.8%), no exploitation in the wild is known and it is not in the CISA KEV catalog.

What to do: Upgrade the Wazuh manager to 4.14.6 or 5.0.0-beta3 or later as soon as possible. Restrict the cluster daemon (port 1516) to fully trusted peers, rotate the cluster Fernet key if any peer or key material may have been compromised, and audit /var/ossec/etc/ossec.conf and other files outside expected cluster directories for unauthorized writes. Review wazuh-clusterd and manager logs for synchronization errors or writes involving unusual traversal-like file names.