CVE-2026-49441

Wazuh contains an external control of file name or path flaw (CWE-73) in the cluster synchronization logic of the master: the non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusts the file_path key supplied by a peer in files_metadata. and joins it to WAZUH_PATH without verifying it stays inside the directory selected by cluster_item_key. A malicious or compromised cluster worker that holds the shared Fernet key can upload a crafted 'extra-valid' archive during sync and overwrite files outside the intended directory on the master, including /var/ossec/etc/ossec.conf. Because ossec.conf governs root-executed components such as command and active-response definitions, replacing it can lead to root-level code execution when the service reloads. All deployments from 4.3.0 up to (but not including) 4.14.6, plus pre-release 5.0.0 beta code prior to the fix, are affected, but exploitation requires an authenticated cluster peer, which limits opportunistic attacks. No exploitation in the wild is known (EPSS 0.5%, not in CISA KEV), though the flaw is documented in a public security advisory.

What to do: Upgrade the Wazuh manager to 4.14.6 (or the fixed 5.0.0-beta3 pre-release line) as soon as possible. Restrict the cluster port (TCP 1516) and manager APIs to trusted hosts, and rotate the cluster Fernet/shared key if any worker node may have been compromised. Audit /var/ossec/etc/ossec.conf and other files under /var/ossec for unauthorized changes and review manager logs for unexpected file syncs from worker nodes.