CVE-2026-74038: Wazuh Path Traversal Vulnerability

CVE-2026-74038 Overview

CVE-2026-74038 is a path traversal vulnerability [CWE-22] affecting Wazuh versions 4.0.0 through 4.14.5. The flaw resides in the agent enrollment process and allows unauthenticated remote attackers to trigger a denial of service. An attacker enrolls an agent with a dot-sequence name such as .. through the enrollment port. The Wazuh manager resolves the traversal to the parent queue directory and removes its subdirectories. This action stops all Wazuh services and requires manual recovery by administrators.

Critical Impact
Unauthenticated attackers can remotely disable Wazuh monitoring infrastructure by sending a single malformed enrollment request, leaving environments without security telemetry until manual recovery is performed.

Affected Products

Wazuh 4.0.0 through 4.14.5
Wazuh Manager enrollment service
Wazuh deployments exposing the enrollment port to untrusted networks

Discovery Timeline

2026-08-18 - CVE-2026-74038 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-74038

Vulnerability Analysis

The vulnerability affects the Wazuh manager's agent enrollment workflow. Wazuh validates agent names through the OS_IsValidName() function before creating filesystem artifacts tied to the enrolled agent. This function fails to reject dot-sequence values such as .., permitting them as valid agent identifiers.

Once the agent is enrolled, downstream cleanup routines including delete_diff() concatenate the attacker-controlled name into filesystem paths without sanitization. The concatenated path resolves upward from the agent-specific queue directory to the parent queue directory. Wazuh then recursively removes the contents of that parent directory as part of its normal cleanup logic.

The removal destroys queue subdirectories required for agent communication, event processing, and manager operation. All Wazuh services fail because their expected directory structure no longer exists. Administrators must recreate the directory hierarchy and restart services to restore monitoring.

Root Cause

The root cause is insufficient input validation combined with unsafe path concatenation. OS_IsValidName() does not filter path traversal sequences, and delete_diff() treats agent names as trusted input when building filesystem paths. Neither function canonicalizes paths or verifies that resolved locations remain within the intended queue directory.

Attack Vector

The attack requires network access to the Wazuh manager's enrollment port. No authentication is required. An attacker submits an enrollment request with the agent name set to .. or a similar dot-sequence value. When the manager later processes cleanup routines against that agent record, the traversal executes and destroys parent queue directories. The vulnerability is exploitable in any deployment where the enrollment service is reachable by untrusted clients.

See the GitHub Security Advisory GHSA-573w-mqw4-jvmr for additional technical detail.

Detection Methods for CVE-2026-74038

Indicators of Compromise

Enrollment log entries showing agent names containing .., ., or other dot-only or dot-sequence values
Unexpected removal or emptying of subdirectories under the Wazuh queue directory (typically /var/ossec/queue/)
Sudden failure of multiple Wazuh daemons (wazuh-analysisd, wazuh-remoted, wazuh-db) without a corresponding administrator action
Loss of agent connectivity across the entire fleet at the same timestamp

Detection Strategies

Monitor Wazuh manager logs for enrollment events referencing agent names that match traversal patterns
Alert on unauthenticated connections to the enrollment port from unexpected source addresses
Watch filesystem integrity for deletions inside /var/ossec/queue/ that are not tied to administrative maintenance

Monitoring Recommendations

Forward Wazuh manager logs to a central logging or SIEM platform for correlation with network telemetry
Track the health state of Wazuh services and alert when multiple daemons stop simultaneously
Baseline expected enrollment source IP ranges and flag deviations for review

How to Mitigate CVE-2026-74038

Immediate Actions Required

Upgrade Wazuh to version 4.14.6 or later, which contains the fix delivered in Wazuh Pull Request 35833
Restrict network access to the Wazuh enrollment port so that only trusted management networks can reach it
Review recent enrollment logs for agent names containing traversal characters and investigate any matches

Patch Information

Wazuh 4.14.6 addresses the vulnerability by tightening validation in OS_IsValidName() and preventing unsafe path concatenation in delete_diff(). Details are published in the VulnCheck advisory for the Wazuh path traversal DoS and the vendor's security advisory GHSA-573w-mqw4-jvmr.

Workarounds

Place the Wazuh manager behind a firewall that limits enrollment traffic to known agent subnets
Require pre-shared enrollment passwords and disable anonymous enrollment where operationally feasible
Deploy network-level filtering to drop enrollment requests containing suspicious character sequences before they reach the manager

bash

# Configuration example: restrict enrollment access with iptables
iptables -A INPUT -p tcp --dport 1515 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1515 -j DROP