CVE-2026-74031 Overview
CVE-2026-74031 is a path traversal vulnerability [CWE-22] in Wazuh, an open source security monitoring platform. The flaw resides in the delete_rule_file and delete_decoder_file helper functions used by the Wazuh cluster. Versions from 4.1.1 before 4.14.8 fail to validate the filename parameter supplied through the DistributedAPI. An attacker holding the cluster key can submit traversal sequences to delete arbitrary files owned by the wazuh user, including ossec.conf, client.keys, and rule files.
Critical Impact
Attackers with cluster worker access can delete core Wazuh configuration and key material, disrupting monitoring and breaking agent authentication across the deployment.
Affected Products
- Wazuh 4.1.1 through 4.14.7
- Wazuh manager and cluster worker components
- Deployments exposing the DistributedAPI to authenticated cluster peers
Discovery Timeline
- 2026-10-13 - CVE-2026-74031 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-74031
Vulnerability Analysis
Wazuh clusters synchronize rule and decoder files between master and worker nodes using the DistributedAPI. The delete_rule_file and delete_decoder_file helpers accept a filename argument and remove the referenced file from the manager filesystem. The helpers do not canonicalize the path or restrict deletion to the designated rule and decoder directories.
An attacker that controls a cluster worker, or that holds the shared cluster key, can submit crafted filenames containing ../ sequences. The manager resolves the path relative to its rules or decoders directory and removes the target file as the wazuh user. Deleting ossec.conf prevents the manager from starting. Deleting client.keys severs agent authentication state. Removing rule files silently reduces detection coverage.
Root Cause
The root cause is missing input validation on the filename parameter passed from DistributedAPI handlers to filesystem delete operations. The helpers trust cluster-authenticated callers and do not enforce a basename-only policy or restrict deletions to an allowlisted directory tree.
Attack Vector
Exploitation requires network access to the cluster communication channel and possession of the cluster key, which maps to the high privileges required reflected in the CVSS vector. Once authenticated to the cluster, the attacker invokes the DistributedAPI delete helpers with a traversal payload in the filename field. The manager executes the deletion without prompting the operator, producing an integrity and availability impact without touching confidentiality.
See the GitHub Security Advisory GHSA-w4qc-m4j4-6m9c and the VulnCheck Wazuh Path Traversal Advisory for additional technical detail.
Detection Methods for CVE-2026-74031
Indicators of Compromise
- Unexpected deletion of ossec.conf, client.keys, or files under /var/ossec/etc/rules/ and /var/ossec/etc/decoders/.
- DistributedAPI request logs containing .. or encoded traversal sequences in the filename parameter of rule or decoder delete operations.
- Manager service failing to start or agents disconnecting en masse following cluster activity.
Detection Strategies
- Audit Wazuh API and cluster logs for delete_rule_file and delete_decoder_file invocations with suspicious filename values.
- Enable filesystem auditing (auditd) on /var/ossec/etc/ to record delete events performed by the wazuh user.
- Correlate cluster worker authentication events with subsequent file-removal activity on the master node.
Monitoring Recommendations
- Alert on any modification or deletion of ossec.conf and client.keys outside of change windows.
- Monitor the integrity of the rules and decoders directories using file integrity monitoring tools.
- Track Wazuh manager process restarts and agent key re-registrations as potential downstream indicators.
How to Mitigate CVE-2026-74031
Immediate Actions Required
- Upgrade all Wazuh manager and worker nodes to version 4.14.8 or later.
- Rotate the cluster key and any credentials shared across cluster peers.
- Back up ossec.conf, client.keys, and custom rule and decoder files before upgrading.
Patch Information
Wazuh fixed the vulnerability in version 4.14.8. The release adds path validation to the delete_rule_file and delete_decoder_file helpers so that only basenames within the designated directories are accepted. Download details are available on the GitHub Wazuh Release v4.14.8 page.
Workarounds
- Restrict network access to the cluster port so only trusted manager and worker IP addresses can connect.
- Store the cluster key in a secrets manager and limit filesystem access to the wazuh user.
- Deploy file integrity monitoring on the manager configuration and rule directories to detect tampering until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
