CVE-2026-44252: Wazuh Manager Auth Bypass Vulnerability

CVE-2026-44252 Overview

CVE-2026-44252 affects Wazuh, an open source platform for threat prevention, detection, and response. The vulnerability exists in Wazuh Manager versions 4.0.0 through 4.14.4. A low-privilege API user holding the manager:read permission can retrieve the cluster key from ossec.conf via the GET /manager/configuration?raw=true endpoint. An attacker with network access to TCP port 1516 can then use the disclosed Fernet key to impersonate a cluster worker and inject attacker-controlled rbac_permissions into distributed API requests. The master node trusts these worker-supplied contexts, allowing full administrative takeover. The issue is classified as [CWE-863] Incorrect Authorization and is fixed in version 4.14.5.

Critical Impact
An authenticated read-only user can escalate to full cluster administrator, create privileged accounts, harvest credentials and API tokens, alter configuration, and execute arbitrary actions across all managed agents.

Affected Products

Wazuh Manager 4.0.0 through 4.14.4
Wazuh clustered deployments exposing TCP port 1516
Wazuh 5.0.0 pre-beta3 builds (fixed in v5.0.0-beta3)

Discovery Timeline

2026-08-19 - CVE-2026-44252 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-44252

Vulnerability Analysis

The vulnerability chains two authorization weaknesses in the Wazuh Manager. First, the /manager/configuration?raw=true endpoint returns the raw contents of ossec.conf, including the <key> element inside the <cluster> block. This block contains the Fernet symmetric key used to authenticate cluster peers. The API filters permissions on the endpoint itself but does not redact sensitive fields when serving the raw configuration.

Second, the master node accepts distributed API (DAPI) requests from workers on TCP port 1516 and trusts the rbac_permissions and rbac_mode values supplied in those requests. Any peer that can authenticate with the cluster key inherits the authorization context of any user it chooses to name. Combined, the two flaws let a manager:read user pivot from information disclosure to full role-based access control (RBAC) bypass.

Root Cause

The root cause is improper authorization ([CWE-863]) at two layers. Sensitive cluster secrets are exposed through a read-only configuration endpoint, and the DAPI channel implicitly trusts worker-supplied RBAC metadata rather than deriving it server-side from an authenticated identity.

Attack Vector

An authenticated attacker with manager:read permission issues a GET request to /manager/configuration?raw=true and extracts the Fernet cluster key from the returned XML. The attacker then opens a TCP connection to port 1516 on the master, encrypts a forged DAPI request with the stolen key, and sets rbac_mode to black with an empty rbac_permissions list. The master interprets this as an unrestricted context and executes the request. From there, the attacker can invoke endpoints to create users, assign the administrator role, retrieve API tokens, modify agent groups, and push commands to endpoints. See the Wazuh Security Advisory GHSA-34fx-c2xw-xcpg for technical details.

Detection Methods for CVE-2026-44252

Indicators of Compromise

API access logs showing GET /manager/configuration?raw=true requests from non-administrative users.
Unexpected inbound TCP connections to port 1516 from hosts that are not registered cluster workers.
New user accounts, role assignments, or API tokens created outside of change-management windows.
Configuration modifications or active-response executions with no corresponding administrative session.

Detection Strategies

Audit Wazuh API access logs for the raw=true query parameter used by low-privilege accounts.
Correlate authentication events on the API with cluster socket activity on port 1516 to identify anomalous worker sessions.
Alert on RBAC changes such as new users, role additions, and token issuance events emitted by the Wazuh Manager.

Monitoring Recommendations

Forward Wazuh Manager and API logs to a centralized SIEM or data lake for retention and correlation.
Baseline the set of legitimate cluster worker IP addresses and alert on deviations to TCP 1516.
Track privilege escalation patterns where a manager:read account is followed by administrator-only API calls.

How to Mitigate CVE-2026-44252

Immediate Actions Required

Upgrade Wazuh Manager to version 4.14.5 or 5.0.0-beta3 without delay.
Rotate the cluster Fernet key after upgrade to invalidate any previously disclosed value.
Review all API users and revoke manager:read from accounts that do not require configuration access.
Audit existing users, roles, and API tokens for unauthorized additions and revoke suspicious credentials.

Patch Information

The fix is delivered in Wazuh Release v4.14.5 and Wazuh Release v5.0.0-beta3. The corrective changes are visible in the Wazuh GitHub Commit and Wazuh Pull Request #35307, which redact cluster secrets from the raw configuration endpoint and stop trusting worker-supplied RBAC contexts on the master.

Workarounds

Restrict TCP port 1516 with host-based firewalls so only known cluster peers can connect.
Remove the manager:read permission from all non-administrative RBAC policies until patching is complete.
Place the Wazuh API behind a reverse proxy that blocks the raw=true query parameter for non-admin roles.

bash

# Configuration example
# Restrict cluster port 1516 to known worker IPs (Linux iptables)
iptables -A INPUT -p tcp --dport 1516 -s 10.0.0.11 -j ACCEPT
iptables -A INPUT -p tcp --dport 1516 -s 10.0.0.12 -j ACCEPT
iptables -A INPUT -p tcp --dport 1516 -j DROP

# Verify installed Wazuh Manager version
/var/ossec/bin/wazuh-control info | grep WAZUH_VERSION