ZDI-26-527: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI discloses CVE-2026-44901, a 9.9-rated deserialization RCE in Wazuh cluster DAPI requiring low-privileged code on a worker node.
ZDI-26-527 describes a deserialization of untrusted data flaw in Wazuh's cluster DAPI protocol allowing network-adjacent attackers to execute arbitrary code. Exploitation requires the attacker to first obtain low-privileged code execution on a worker node. ZDI assigned a CVSS score of 9.9, and the flaw is tracked as CVE-2026-44901.
- CVSS 9.9 deserialization flaw in Wazuh cluster DAPI protocol
- Network-adjacent attackers can achieve remote code execution
- Requires prior low-privileged code execution on a worker node
- Tracked as CVE-2026-44901
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-44901 | Deserialization-of-Untrusted-Data RCE in Wazuh Cluster Distributed API CVE-2026-44901 is a deserialization flaw (CWE-502) in AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py of the Wazuh security platform, where the sort_casting field in a cluster worker's JSON response is trusted without validation. During a distributed API (DAPI) merge across a Wazuh cluster, attacker-controlled type names are resolved through Python builtins without an allowlist, so a compromised worker can set sort_casting to exec and embed Python source in affected_items. When the master node merges responses from multiple nodes, it executes the injected payload as root, giving the attacker full confidentiality, integrity, and availability impact on the master (CVSS 8.4, scope changed). Only deployments running Wazuh 4.0.0 through 4.14.5 or 5.0.0 pre-release versions before 5.0.0-beta2 in multi-node cluster mode are exposed, and exploitation requires a worker node to already be compromised (adjacent network, high privileges). No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS estimates a 0.4% probability of exploitation in the next 30 days. Do: Upgrade Wazuh 4.x deployments to 4.14.6 or later, and 5.x deployments to 5.0.0-beta2 or later. Until patched, restrict access to cluster/DAPI communication between nodes and treat any compromised worker as capable of achieving root code execution on the master. With no public PoC and low EPSS, standard patch cycles are acceptable, but cluster operators should prioritize the update because a single worker compromise can escalate to full master takeover as root. | 8.4 | <1% | PoC |
| large≈ tens of thousands of Wazuh installations, of which only multi-node cluster deployments with a compromised worker are exploitable |
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wazuh. An attacker must first obtain the ability to execute low-privileged code on a worker node in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.9. The following CVEs are assigned: CVE-2026-44901.
This source does not provide full text. Read it at zerodayinitiative.com.