CVE-2026-48024: Wazuh Path Traversal Vulnerability

CVE-2026-48024 Overview

CVE-2026-48024 is a path traversal vulnerability [CWE-22] in the Wazuh open source threat detection platform. The flaw affects cluster synchronization logic in versions 4.0.0 through 4.14.5 and 5.0.0-beta releases prior to 5.0.0-beta3. A cluster peer holding the shared Fernet key can inject traversal sequences into files_metadata.json or merged-file headers. This lets an attacker write arbitrary files, including /var/ossec/etc/ossec.conf, and gain root code execution when Wazuh services reload.

Critical Impact
An authenticated cluster peer can overwrite ossec.conf to configure root-executed commands, resulting in remote code execution across the Wazuh cluster.

Affected Products

Wazuh 4.0.0 through 4.14.5
Wazuh 5.0.0-beta1 and 5.0.0-beta2
Wazuh cluster components (framework/wazuh/core/cluster/)

Discovery Timeline

2026-08-19 - CVE-2026-48024 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-48024

Vulnerability Analysis

The vulnerability resides in Wazuh's cluster synchronization code path. The function cluster.unmerge_info() in framework/wazuh/core/cluster/cluster.py constructs filesystem paths from peer-controlled merge_type and name values extracted from a merged synchronization archive. These values flow directly into path joins without sanitization for traversal sequences.

Downstream, process_files_from_worker() in framework/wazuh/core/cluster/master.py fails to confine the resulting path to the declared cluster item directory. A malicious worker can therefore direct writes anywhere the master process has permission, which runs as root. Writing to /var/ossec/etc/ossec.conf allows the attacker to inject <command> blocks executed on service reload.

Root Cause

The root cause is missing input validation on synchronization metadata. Both the merge_type and filename fields accept /, \, and leading . characters. The cluster_item_key was also not validated against the known cluster items map, letting attackers reference arbitrary destinations.

Attack Vector

Exploitation requires possession of the shared cluster Fernet key, so the attacker must already control a cluster peer. The peer sends a crafted merged archive containing traversal payloads in files_metadata.json or merged-file headers. The master node writes attacker-controlled content to a privileged path, achieving root code execution on reload.

python

# Security patch in framework/wazuh/core/cluster/cluster.py
# fix(cluster): validate merge file parameters to prevent directory escape

    Raises
    ------
    WazuhClusterError
        If parameters contain invalid characters.
    """
    if '/' in merge_type or '\\' in merge_type or merge_type.startswith('.'):
        raise WazuhException(3052, extra_message=f"Invalid merge_type: {merge_type}")

    if '/' in filename or '\\' in filename or filename.startswith('.'):
        raise WazuhException(3052, extra_message=f"Invalid merge filename: {filename}")

    src_path = path.abspath(path.join(path_file, filename))
    dst_path = path.join("queue", merge_type)

Source: GitHub Commit 88fc89f

python

# Security patch in framework/wazuh/core/cluster/master.py
# fix(cluster): validate cluster_item_key against known items

                    full_path = safe_join(common.WAZUH_PATH, file_path)
                    item_key = data['cluster_item_key']

                    if item_key not in cluster_items['files']:
                        raise exception.WazuhClusterError(3022, extra_message=f"Invalid cluster_item_key: {item_key}")

                    # Only valid client.keys is the local one (master).
                    if os.path.basename(file_path) == 'client.keys':
                        raise exception.WazuhClusterError(3007)

Source: GitHub Commit 88fc89f

Detection Methods for CVE-2026-48024

Indicators of Compromise

Unexpected modifications to /var/ossec/etc/ossec.conf or files under /var/ossec/etc/ outside of change windows.
New <command> or <localfile> entries in ossec.conf referencing untrusted binaries or scripts.
Cluster synchronization archives containing merge_type or filename values with /, \, or leading . characters.
Wazuh cluster.log entries showing writes to paths outside declared cluster item directories.

Detection Strategies

Monitor file integrity on /var/ossec/etc/ and Wazuh binaries; Wazuh's own FIM can be pointed at these paths.
Inspect cluster protocol logs for files_metadata.json entries containing traversal characters in merge_type or name fields.
Alert on Wazuh manager process restarts followed by execution of unexpected child processes.

Monitoring Recommendations

Enable audit logging on /var/ossec/etc/ossec.conf writes and correlate with cluster sync events.
Track process ancestry for wazuh-execd and other root-executed Wazuh services to catch anomalous command execution.
Rotate and monitor use of the cluster Fernet key; treat any peer holding it as a privileged asset.

How to Mitigate CVE-2026-48024

Immediate Actions Required

Upgrade all cluster nodes to Wazuh 4.14.6 or 5.0.0-beta3 immediately.
Rotate the cluster Fernet key after patching to invalidate any compromised peer credentials.
Audit ossec.conf on all managers for unauthorized <command> entries added prior to the upgrade.
Restrict network access to the cluster port (default 1516) to trusted management interfaces only.

Patch Information

The fix is available in Wazuh Release v4.14.6 and Wazuh Release v5.0.0-beta3. The remediation is tracked in GitHub Pull Request #36204 and detailed in the GitHub Security Advisory GHSA-gh4h-fx78-q8xc. The patch validates merge_type, filename, and cluster_item_key values before path construction.

Workarounds

Isolate cluster peers on a dedicated, tightly firewalled network segment to limit key exposure.
Enforce strict file permissions and ownership on /var/ossec/etc/ossec.conf and monitor with FIM until patching is complete.
Disable multi-node cluster mode temporarily on non-critical deployments where a single manager is acceptable.

bash

# Upgrade Wazuh manager to the patched release
sudo systemctl stop wazuh-manager
sudo apt-get update && sudo apt-get install wazuh-manager=4.14.6-1
sudo systemctl start wazuh-manager

# Verify installed version
/var/ossec/bin/wazuh-control info | grep WAZUH_VERSION

# Rotate the cluster Fernet key in /var/ossec/etc/ossec.conf
# <cluster><key>NEW_32_BYTE_BASE64_KEY</key></cluster>
sudo /var/ossec/bin/wazuh-control restart