CVE-2026-61802

Wazuh 4.14.0 through 4.14.6 fails to redact sensitive fields on the GET /cluster/local/config REST API endpoint, which is the only config-read endpoint missing the mask_sensitive_config decorator. Any authenticated low-privilege API user — including those holding the default readonly or cluster_readonly roles, which are explicitly denied update-config precisely to keep secrets hidden — receives the local node's cleartext cluster key, while sibling endpoints return the same value masked. Because the cluster key authenticates and encrypts traffic between Wazuh cluster nodes, its disclosure gives an unprivileged attacker the authentication precondition needed to launch the previously documented cluster-peer remote code execution chains. Only deployments running the affected 4.14.x versions with clustering enabled and low-privilege API accounts provisioned are exposed. No exploitation in the wild is known; the sole public reference is the vendor's GitHub security advisory, and EPSS sits at a low 0.4%.

What to do: Upgrade to the fixed 4.14 release (4.14.7 or later, per the vendor advisory) as soon as practical. Rotate the cluster key on affected deployments, since any low-privilege API user who previously queried the endpoint may hold the old value. Review Wazuh API logs for GET /cluster/local/config requests from readonly/cluster_readonly accounts, and inspect cluster nodes for signs of the downstream cluster-peer RCE chains; until patched, restrict API access and remove unnecessary low-privilege accounts.