CVE-2026-74033: Wazuh Path Traversal Vulnerability

CVE-2026-74033 Overview

CVE-2026-74033 is a path traversal vulnerability [CWE-22] in Wazuh affecting versions from 4.1.1 before 4.14.8. The flaw exists in the get_lists() and delete_list_file() Constant Database (CDB) list handlers used by the cluster communication layer. A compromised cluster worker can send traversal sequences or absolute-path filenames through the internal cluster Remote Procedure Call (RPC) path, bypassing REST validation and Role-Based Access Control (RBAC). Successful exploitation lets attackers read or delete arbitrary master-node files, including rbac.db.

Critical Impact
An attacker in control of a worker node can delete the Wazuh master's rbac.db and other sensitive files, undermining access control and cluster integrity.

Affected Products

Wazuh versions 4.1.1 through 4.14.7
Wazuh cluster deployments using CDB list handlers
Wazuh master nodes receiving RPC calls from worker nodes

Discovery Timeline

2026-10-13 - CVE-2026-74033 published to the National Vulnerability Database (NVD)
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-74033

Vulnerability Analysis

Wazuh clusters distribute configuration and policy data between a master node and one or more worker nodes. The CDB list handlers get_lists() and delete_list_file() accept filename parameters over the internal cluster RPC transport. REST API endpoints that expose equivalent functionality enforce path sanitization and RBAC checks. The internal RPC path does not perform the same validation.

A worker node that has been compromised can craft RPC requests containing ../ traversal sequences or absolute paths such as /var/ossec/api/configuration/security/rbac.db. The master node resolves these paths against its own filesystem and performs the requested read or delete. Deleting rbac.db removes stored role, policy, and user data, which can disable authorization enforcement across the cluster.

Root Cause

The vulnerability stems from inconsistent input validation between external and internal interfaces. The REST layer sanitizes filenames and applies RBAC, while the cluster RPC handlers trust input from peer nodes. The handlers do not canonicalize paths or confine operations to the designated CDB lists directory.

Attack Vector

Exploitation requires an adjacent-network position with high privileges, specifically control of a Wazuh cluster worker. No user interaction is needed. The attacker sends a crafted RPC message naming the target filename. The master executes get_lists() to return file contents or delete_list_file() to remove the file. See the GitHub Security Advisory GHSA-vc33-wcqf-cwgv for additional protocol-level details.

See the vendor advisory for proof-of-concept details.
No verified public exploit code is available at this time.

Detection Methods for CVE-2026-74033

Indicators of Compromise

Unexpected deletion or modification of rbac.db or other files under /var/ossec/ on the master node
Cluster RPC messages containing ../ sequences or absolute paths in CDB list filename parameters
Authorization failures or RBAC inconsistencies across cluster nodes following worker node activity

Detection Strategies

Inspect Wazuh cluster logs for get_lists and delete_list_file RPC calls referencing filenames outside the expected CDB lists directory
Monitor file integrity on master-node paths holding rbac.db, agent keys, and configuration files
Correlate worker-node compromise indicators with master-node file operations occurring in the same time window

Monitoring Recommendations

Enable file integrity monitoring on /var/ossec/api/configuration/ and /var/ossec/etc/lists/ on master nodes
Alert on any cluster RPC traffic from worker nodes that contains path separators or traversal patterns in filename fields
Audit Wazuh version inventory across all cluster members to identify nodes still running affected releases

How to Mitigate CVE-2026-74033

Immediate Actions Required

Upgrade all Wazuh master and worker nodes to version 4.14.8 or later as documented in the Wazuh v4.14.8 release notes
Restrict cluster network segments so that only authorized worker nodes can reach the master RPC port
Review rbac.db integrity and restore from backup if tampering is suspected

Patch Information

Wazuh fixed the vulnerability in version 4.14.8. The patch adds filename validation to the get_lists() and delete_list_file() cluster handlers, blocking traversal sequences and absolute paths. Refer to the Vulncheck advisory for scope and remediation guidance.

Workarounds

Isolate cluster traffic on a dedicated management network with strict firewall rules between workers and the master
Rotate cluster authentication keys and limit worker-node privileges where feasible until patching is complete
Increase monitoring on master-node filesystems and back up rbac.db and configuration files frequently

bash

# Upgrade Wazuh manager to the patched release
sudo apt-get update
sudo apt-get install wazuh-manager=4.14.8-1
sudo systemctl restart wazuh-manager