CVE-2026-48162

Wazuh versions from 4.0.0 through 4.14.5 and 5.0.0 beta releases prior to 5.0.0-beta3 contain a path traversal (CWE-73) in DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py, which joins an attacker-controlled tmp_file value to WAZUH_PATH without canonicalization or confinement. A malicious cluster peer that already holds the shared cluster Fernet key can supply traversal sequences or an absolute path to make the master return any file readable by the master process over the cluster channel. By reading /var/ossec/api/configuration/security/private_key.pem, the attacker can forge administrator REST API tokens offline and exercise full administrative privileges on the Wazuh API without ever creating an account. Only deployments running Wazuh in clustered mode are exposed, and exploitation requires high privileges (a compromised peer or leaked Fernet key), consistent with the CVSS 9.1 rating (PR:H, scope changed). The issue is fixed in 4.14.6 and 5.0.0-beta3; only the vendor advisory is public and no in-the-wild exploitation is known.

What to do: Upgrade Wazuh server/cluster components to 4.14.6 or 5.0.0-beta3 or later. Restrict the cluster communication port so only trusted worker nodes can reach the master, and rotate the API private key, cluster Fernet key, and any embedded credentials if a peer may have been compromised. Review master logs for anomalous send_tmp_file / file-distribution requests containing traversal sequences or unexpected absolute paths, and treat any existing API tokens as potentially forged.